<?xml version='1.0' encoding='UTF-8'?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
  <id>8b8b08e07bc04295970e5eff0b294bb2</id>
  <title>www.filescan.io feed</title>
  <updated>2026-10-05T13:17:12Z</updated>
  <author>
    <name>Filescan.io</name>
    <email>admin@filescan.io</email>
  </author>
  <link href="https://www.filescan.io"/>
  <generator>Filescan.io feed generator</generator>
  <logo>https://www.filescan.io/assets/logo.png</logo>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T13:14:30Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a2c389017dd18dc1c3e5</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac3a2b3b242df12a78e3a73</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>256a9eab-10c7-4fe0-9173-471a20322176</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T13:14:24Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a2bfd130e7ad45267a98</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac3a2aeb242df12a78e3a31</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>517906ab-7489-4dfa-9574-4761ba9b92c6</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>6deee0eeb88f5fb4bcc038969a31bd3b9faae20a874ca31706dd1cb2af0df32b</id>
    <title>Analysis Report for 6deee0eeb88f5fb4bcc038969a31bd3b9faae20a874ca31706dd1cb2af0df32b</title>
    <updated>2026-10-05T13:14:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a315d130e7ad45267aad</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6ac3a2aab242df12a78e39fd</flow_id>
        <hash>6deee0eeb88f5fb4bcc038969a31bd3b9faae20a874ca31706dd1cb2af0df32b</hash>
        <iocs>
          <urls>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://office.microsoft.com/0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://officecdn.microsoft.com/db</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://officecdn.microsoft.com/pr</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://officecdn.microsoft.com/sg</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/PKI/docs/CPS/default.htm0@</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/docs/primarycps.htm0@</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://nexus.officeapps.live.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://nexusrules.officeapps.live.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>crl.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>nexus.officeapps.live.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>nexusrules.officeapps.live.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>office.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>officecdn.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>2.16.164.67</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.110.210</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>146.75.122.172</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>4c7f460ed9b43c620fcbd44d28394b8729e52d3d29f7e9086239bccb69ce8be1</SHA-256>
              <SHA-1>cca4ab1703ac11cab1a8096ee0a083c1fb3b4bf8</SHA-1>
              <MD5>26ec738acecc185a7dcf63f67fb0d0a8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>905e6eb9eee7ffc968208b700ce8809ff0dfe73cc4e3757bcf5efde311cc0c43</SHA-256>
              <SHA-1>885519f0620ea36d525448d656809ec08364c990</SHA-1>
              <MD5>77d778077a5f6b0f32dc88f8b2878775</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>8e021fc02ff0de103c5caaecbdcc4ba81e31e59c14cd395bac93759433135e09</SHA-256>
              <SHA-1>723c71a7e9217222916cf22477efd8bafe3984a9</SHA-1>
              <MD5>fcba97f62417b5f3d9ec61e2ed77098d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>04079350-16fa-4c60-b6bf-9d2b1cd05984</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>49e8c3f3-2359-47f6-a3be-6c8c4751c4b6</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>7971f918-a847-4430-9279-4a52d1efe18d</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\AppDataLow\Microsoft\Office</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\ClickToRun\OverRide</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Office</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Office\16.0\common\filespaths</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Office\ClickToRun</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Policies\Microsoft\Office</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>C2R32.dll</name>
        <report_id>fa118a7a-b4fd-449f-83dc-8f6237043ae0</report_id>
        <tags>
          <value>peexe</value>
          <value>txt</value>
          <value>html</value>
          <value>pedll</value>
          <value>expand</value>
          <value>lolbin</value>
          <value>reconnaissance</value>
          <value>obfuscated</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>evasive</value>
          <value>greyware</value>
          <value>keylogger</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>17d3ca6f8f7a0ce80fc6f225887cdc6aa4478fa2cbaf57e07877f0bbfaf251e4</id>
    <title>Analysis Report for 17d3ca6f8f7a0ce80fc6f225887cdc6aa4478fa2cbaf57e07877f0bbfaf251e4</title>
    <updated>2026-10-05T13:14:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a33fd130e7ad45267ab7</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6ac3a2aab242df12a78e39fd</flow_id>
        <hash>17d3ca6f8f7a0ce80fc6f225887cdc6aa4478fa2cbaf57e07877f0bbfaf251e4</hash>
        <iocs>
          <urls>
            <value>
              <url>https://fineprint.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fineprint.com/help/fineprint</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fineprint.com/help/pdffactory</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>fineprint.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>172.67.73.48</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>0cf988c537a50f78d684ae22e2824cef4be5558358dcc6fd390735c61bd236f6</SHA-256>
              <SHA-1>a1a846ab316ee4c2d68c805736c7a6f62555b306</SHA-1>
              <MD5>992aa5db71203291f10d67a126816313</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>3504a1e77e6c774e07a0d6b75547298482708b9eabbb73503ca2ee04fe0ef067</SHA-256>
              <SHA-1>a5f55bc701486758a80e9588aca8cbcb5a5022cb</SHA-1>
              <MD5>2d960251bd2d91d3471907e73e7b7356</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>466ab6a637ff97e73db92b21930c13ddd5d8da9fb3f09f8bbfa01ea5beaa6b83</SHA-256>
              <SHA-1>e7dbbbd28c65d773606b8605e10c86d792ed523e</SHA-1>
              <MD5>874cfa66e062915417a8b35d1e5f335c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>4f18ec6c3fdd38e041f21d4d67454ef6339c854d015127cacdfa68fe1bb39115</SHA-256>
              <SHA-1>5a313a62a3fccb6571e3518a9c8c95c5f91b9dc7</SHA-1>
              <MD5>5f4b2283a03753e12f30017d7a042717</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>5583f3acffce686e1a652a8cc03baf2a09f445024c88c1be74bf27fe9934fa30</SHA-256>
              <SHA-1>0df733a6c82244669d65f84b0f548391322d414c</SHA-1>
              <MD5>f0a5ddaab1538498f52622c5420cf23e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>585cca1ff4877c087d724c4dab9711b0542859cd032d264c2597add2084b0978</SHA-256>
              <SHA-1>7de6b74e736127a8e699de7d74d6f16e7dbaeb0c</SHA-1>
              <MD5>50dbbb0728324d73ecada31dfe895066</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>606459a7e4479fc51a262a4466530ae0e2fb38bba52b16738df7a9adb54a8340</SHA-256>
              <SHA-1>7c185e3c25f754870bdf185255c88c4e8df62e01</SHA-1>
              <MD5>43755935908cb37346af1cb11aeb1452</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>79b0f95a519f3f9fd0a52648980a84a4875e6c33e73fcad2d04cc6458cecacd4</SHA-256>
              <SHA-1>2396dbc53cde2d891dfe688fa3a9b5b5cb571409</SHA-1>
              <MD5>a3991c5ec03449f1f475f903a325042f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>7b0372f1573602d5c039fe751394084d70667f4f907a32695235df90b7128266</SHA-256>
              <SHA-1>a42441c033fa553122a10271bbcfce94f5499f2a</SHA-1>
              <MD5>57ed8438f4f7ec26f28c39447a8d9a2e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>7dd3bbdaceb1fe5d5b2617aa3b4b158b7ea4e058d1027de0148b39326050f960</SHA-256>
              <SHA-1>e70eb1d04694426489a8a7ee435e96bf9cb6c675</SHA-1>
              <MD5>9297d4ce24a56a5081f5e5edf0ebbf7d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>7eb92117b4e89018a135554ad2b7cdc71732ba4d20e26f2f2a9a85eecf1d79fc</SHA-256>
              <SHA-1>9ddc5d3e0fa20547271d3321423801219b29b42e</SHA-1>
              <MD5>b168f78c8f075b386b2396f9fca6afe7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>8567e692376fba5b924be1a9bea6d804e0e6fc515a7548c11a95d16d8c5483ca</SHA-256>
              <SHA-1>e0a7f8c52f9d5571f7d4ae6bf3c853562db0b6f6</SHA-1>
              <MD5>818ac46d18b30719091190fb4c2b4bac</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>864178c8870b3abd21acec81581b15bcf061378575fa3ab2a89d907e4178113d</SHA-256>
              <SHA-1>eae5efc38f44e8ec69d1ec2ff20e899aa2991b0d</SHA-1>
              <MD5>f093a4a10c51caa22b3a58019d386ae3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>89155e1342491265b0c9c2eea30ee2e593b93201cd2cb32a73a9ccb42773ea46</SHA-256>
              <SHA-1>12cfeb0ecb2aca75efe8f41511f551a9b7ed51bd</SHA-1>
              <MD5>c5575c02e1fe2b863440152204807a84</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>8af7ee13ae82bc93820b036468dcae65a6d887516ca026549a053949a2fc0816</SHA-256>
              <SHA-1>c5c1e27774da9f1ddfb36728c341ce7454270a8a</SHA-1>
              <MD5>1ad7271f8fc83efdc352bae2fa35e1e0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>967162ead41e6e5cb17c7099cd5515693f4f8bbfee198c0902100aadf010aaa9</SHA-256>
              <SHA-1>08b355fa0a7c4bd83291b428fffdbd2f6402aee0</SHA-1>
              <MD5>6548d08b42325d1cda0a120bdc4b995c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>ac0aeb0193e25363b1d8008ed2facf902b9133f0690f3f3e62b2ce3347114aad</SHA-256>
              <SHA-1>a87cb532571861339674d20b41bbfad48aea2686</SHA-1>
              <MD5>eb1298cce15ae044b6ca67c85d38873e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>af91d27ba71ad2b04a6c43720369e69a08e11f0163fd500ccad7f05b37afced8</SHA-256>
              <SHA-1>4f211f83f54ed5f30c14d71cb6fe170d175d2de2</SHA-1>
              <MD5>6e36d49df49dd6205d7acf570d575cc6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>d82ddfe9a0894e59164e5c8f29f66019a2ca7c9ba3cc291789a876c08b4a8092</SHA-256>
              <SHA-1>d8862d01471df86fa4261aa7254c1239f59c3edb</SHA-1>
              <MD5>7b7cae82d4d672999943335ec085bd16</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>dedc3ef1e633c9096d533c8a421bc5631ffdeaf54d6e92548b35087e80de6c48</SHA-256>
              <SHA-1>ecf1aaabed62875ba8b312d3d6ba5259d6bd0da8</SHA-1>
              <MD5>aa1741484f8feca5df1599855321137e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>e6a0e03cccd3932f208da12184b40daa9c929577345e2c9966bba73c5c3d7dbe</SHA-256>
              <SHA-1>5abc4ae9e10f44bc849ad3952f350cfe695c6725</SHA-1>
              <MD5>2afe73857438c448a8bbaa765d4c4712</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>97fc7d8f47e7cb7dbc1a5406f7168b8770550bdf73a9974093819fe91ebf0936</SHA-256>
              <SHA-1>8f76c681c36085a12999c77f46e24b262afa166d</SHA-1>
              <MD5>c11e1f50e5114a12b28fdccb7ed39563</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>2a47a2f6cc183350dd0edb66b1d478179bbf8b73580621a04f98f70872b8c895</SHA-256>
              <SHA-1>5e45b20e21e4849af4ad64a02e375b32b3ee6605</SHA-1>
              <MD5>250a5e9c7b22b516d984fee0e85be862</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>8b389bbc943bd533c6426ca1fbe0ef6190acca32e3919d81a1b97c9ecfa795a4</SHA-256>
              <SHA-1>aca26604113df361f07de29d88c35818896a60e7</SHA-1>
              <MD5>6e648e37262d8594805861d3b1af4d19</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>20D04FE0-3AEA-1069-A2D8-08002B30309D</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>26EE0668-A00A-44D7-9371-BEB064C98683</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>3080F90D-D7AD-11D9-BD98-0000947B0257</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8895B1C6-B41F-4C1C-A562-0D564250836F</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>9B3E6D36-A994-450D-8252-0BEFD270F29F</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>E357FCCD-A995-4576-B01F-234630154E96</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>ED7BA470-8E54-465E-825C-99712043E01C</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\Classes\</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\FinePrint Software\FinePrint12</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\App Paths</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Policies\Network</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Uninstall</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>AppvIsvSubsystems32.dll</name>
        <report_id>d0ad5a3b-051e-46ec-b4b2-d387edab35ea</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>pedll</value>
          <value>overlay</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>anti-vm</value>
          <value>evasive</value>
          <value>keylogger</value>
          <value>packed</value>
          <value>explorer</value>
          <value>fingerprint</value>
          <value>lolbin</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>base64</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ca74ce9761242263297e84ffb3f653ca673ab809ade857668d1b21116bd576aa</id>
    <title>Analysis Report for ca74ce9761242263297e84ffb3f653ca673ab809ade857668d1b21116bd576aa</title>
    <updated>2026-10-05T13:14:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a2bbd130e7ad45267a97</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac3a2aab242df12a78e39fd</flow_id>
        <hash>ca74ce9761242263297e84ffb3f653ca673ab809ade857668d1b21116bd576aa</hash>
        <iocs>
          <urls>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://office.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/Docs/Repository.htm0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Code%20Signing%20PCA%202024.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Code%20Signing%20PCA%202024.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Third%20Party%20Component%20CA%202013.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Code%20Signing%20PCA%202024.crl0m</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Code%20Signing%20PCA%202024.crl0w</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Third%20Party%20Component%20CA%202013.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>crl.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>office.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>184.25.51.88</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>b75ab9eae60b66474b16f49538ebcc7f9112363632df8f4a069b0f91cc392e92</SHA-256>
              <SHA-1>54a479142f19ded297f988e8ae5b4955d924a697</SHA-1>
              <MD5>62b82d82f2679115c8152056fbef6151</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>5965b2c5472aaca1cd66ea5b0d07a971b961fee72fc27eb1f6c760042084b21b</SHA-256>
              <SHA-1>c795b490811c0e5a1a8f3c3f620aab9f00c34f07</SHA-1>
              <MD5>85de642e1467807f64f7e10807df3869</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>VCRUNTIME140.DLL</name>
        <report_id>a528c944-a48c-4c48-a54d-a652d0893a39</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>xml</value>
          <value>pedll</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>anti-debug</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>418860c3a647e10f8b0669d8c1ca942648e09e6b1ebcf9b80b55fa7b7d24d92e</id>
    <title>Analysis Report for 418860c3a647e10f8b0669d8c1ca942648e09e6b1ebcf9b80b55fa7b7d24d92e</title>
    <updated>2026-10-05T13:14:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a2fbd130e7ad45267aa5</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6ac3a2aab242df12a78e39fd</flow_id>
        <hash>418860c3a647e10f8b0669d8c1ca942648e09e6b1ebcf9b80b55fa7b7d24d92e</hash>
        <iocs>
          <urls>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://office.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/Docs/Repository.htm0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Code%20Signing%20PCA%202024.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Code%20Signing%20PCA%202024.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Third%20Party%20Component%20CA%202013.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Code%20Signing%20PCA%202024.crl0m</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Code%20Signing%20PCA%202024.crl0w</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Third%20Party%20Component%20CA%202013.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>crl.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>office.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>2.16.164.67</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>9197549962831b71d99c1f88ee941633b8b777eff1d2eb16d871e6ae44cc850a</SHA-256>
              <SHA-1>00eb39889c0bd78b89147d5400d5613df355c605</SHA-1>
              <MD5>21ef5207fdbc229830d5fcf9eaf6c1ac</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>5965b2c5472aaca1cd66ea5b0d07a971b961fee72fc27eb1f6c760042084b21b</SHA-256>
              <SHA-1>c795b490811c0e5a1a8f3c3f620aab9f00c34f07</SHA-1>
              <MD5>85de642e1467807f64f7e10807df3869</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <registry>
            <value>
              <registry>SYSTEM\CurrentControlSet\Control\LeapSecondInformation</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>msvcp140_atomic_wait.dll</name>
        <report_id>447f4f0b-13c9-4253-b0c0-6a6d499d9853</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>xml</value>
          <value>pedll</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>anti-debug</value>
          <value>anti-vm</value>
          <value>evasive</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>4411546d36da03e85ee2a65ab34903878276bb7f01bf2a3bf066061837d4781b</id>
    <title>Analysis Report for 4411546d36da03e85ee2a65ab34903878276bb7f01bf2a3bf066061837d4781b</title>
    <updated>2026-10-05T13:14:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a308d130e7ad45267aa9</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6ac3a2aab242df12a78e39fd</flow_id>
        <hash>4411546d36da03e85ee2a65ab34903878276bb7f01bf2a3bf066061837d4781b</hash>
        <iocs>
          <urls>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://office.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/Docs/Repository.htm0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Code%20Signing%20PCA%202024.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Code%20Signing%20PCA%202024.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Third%20Party%20Component%20CA%202013.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Code%20Signing%20PCA%202024.crl0m</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Code%20Signing%20PCA%202024.crl0w</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Third%20Party%20Component%20CA%202013.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>crl.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>office.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>2.16.164.67</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>ab7f03e8e0477343c70276ddfae434e932d0b9691ec60a4bcef8b07e4b3b6e56</SHA-256>
              <SHA-1>16a0bef144b2e1ae89375bfd6c952be5d343288b</SHA-1>
              <MD5>30288aa3d76b7038433f24dd9bab8732</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>533fc9063eaa7d9610b0407b0019ff4746f8c8840ef930e909a6485d70e09b66</SHA-256>
              <SHA-1>ed52d3df20ee2ee19de97338f36d3b721c4a4204</SHA-1>
              <MD5>c3b361d84b34236dec6e933c2b7763d0</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>MSVCP140.DLL</name>
        <report_id>5c1f5147-486b-41a7-9329-7ea91073e079</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>pedll</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>obfuscated</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>anti-debug</value>
          <value>evasive</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>bbceb9c56b016867ac897a1ce3dfbc55e8e562d330f841061644a6fc613528a3</id>
    <title>Analysis Report for bbceb9c56b016867ac897a1ce3dfbc55e8e562d330f841061644a6fc613528a3</title>
    <updated>2026-10-05T13:14:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a34ed130e7ad45267abb</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac3a2aab242df12a78e39fd</flow_id>
        <hash>bbceb9c56b016867ac897a1ce3dfbc55e8e562d330f841061644a6fc613528a3</hash>
        <iocs>
          <urls>
            <value>
              <url>https://analysis.windows-int.net/powerbi/api</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://analysis.windows.net/powerbi/api</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>analysis.windows-int.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>analysis.windows.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>127.0.0.1</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>0eb32a8421e83ec0d1dc013fc251a1721261024085bfbdbdff6c2a5ef65994ea</SHA-256>
              <SHA-1>3e85e4849156f0e039fd4d14d5d1b30e35453e4c</SHA-1>
              <MD5>b3b619a71e4012e4cf8885c0ab497562</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>1a3ceb24d69e774f626e63986cbc6679e118c9c805a91e85ebf86212be6ed3d9</SHA-256>
              <SHA-1>02d56cde030877d2429cbe4d8e1a359b0175fcf3</SHA-1>
              <MD5>31ea10780657b55413c4e7a96ded54df</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>343c33adaff0903057d27182ae781adda39df1967362e85ca0b002d31be909c8</SHA-256>
              <SHA-1>b80e95dc6fa4b9f55ed094a4f9a44f69e84e1c27</SHA-1>
              <MD5>fa18613e094b9612867ec8296c11929f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>46acf7d9d303ce88c0014e7aca95989955ce13e177b92396bad69f60ce72c5f2</SHA-256>
              <SHA-1>d3d6a09f76cfe616ff480c0ba4080a8dbde8c3c6</SHA-1>
              <MD5>d7dd747fea8cc4b72c74040359250d44</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>6bf50cadcde2b618a1837103e001834a436d9973e3ea69e1e979403734b326f3</SHA-256>
              <SHA-1>a4a8fcbd3be5cc7e89005bcaea67806e6b1e187f</SHA-1>
              <MD5>5741d77fc3f92cb361b1de1870a675fc</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>6e0ee331d6decfee5df9fc06c3cffec335e068ec3d94fee4fe47dfcee2f9a0ba</SHA-256>
              <SHA-1>a55abe1632f86e64ae1f658921cd7ffc574fd6ac</SHA-1>
              <MD5>63c02fde894377dda5ca381fb2e892d4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>9c846b84885e73369a6310c9318f5d4acdea943c78084077f975eed31a6fd1f2</SHA-256>
              <SHA-1>5ff9c39a7ebe974660aa11479f9a812657b10546</SHA-1>
              <MD5>47eebff4f29edb1fd98af509cb1ee05d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>bcc0b0371fbb99ab411ea39058e4b8c495412586c9e6694c8c45e1c3307300d9</SHA-256>
              <SHA-1>508495a8027463e4bc769621d66ef89a2084966b</SHA-1>
              <MD5>9aee0cd8c7767f494e26eda65653ad88</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>c3c037feb10c6adcb0dcf82ca7aa347af373ddebd560c6c668830bdf0a24b78a</SHA-256>
              <SHA-1>c74e2ff2f9c6feb17ade988fda9fd3b068a8e6bc</SHA-1>
              <MD5>f65e185fb5e0801582fd8b2d87a3fdd1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>c89de4882b9713b9cbcb06e564dd54bcca9dcd162dd96cfd895774f48455d174</SHA-256>
              <SHA-1>82b60e389d8cf01b6fe1e22772ff907899fc6963</SHA-1>
              <MD5>01ead452dd34a09b32eb9aee5eeebd1c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>cfe74e3ed66cb5a27fff5f6e4fd040d0a33049f9817fb9916d9855cb71838b62</SHA-256>
              <SHA-1>33c8afb55d9f79be12ce881690263efc14127776</SHA-1>
              <MD5>a59fc21bd4c3b1da312c736ec9ab6c83</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>f1693783a0cdbffe50a69291ae86aea83cd247618b41591127c2749aa1c29dc6</SHA-256>
              <SHA-1>f3d0d9f635540dac8eb465d4ba8222cad1e60fbb</SHA-1>
              <MD5>0126ea7fab7c1af7dc50b68e2d53cabb</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
          </files>
        </iocs>
        <name>excel.exe</name>
        <report_id>c0c98578-62c2-4510-98aa-673e54552a4b</report_id>
        <tags>
          <value>peexe</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>anti-vm</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>evasive</value>
          <value>masquerade</value>
          <value>obfuscated</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>435c8cf4051624703741971353b1724a834a4ff8055c61135f575634c0271a5d</id>
    <title>Analysis Report for 435c8cf4051624703741971353b1724a834a4ff8055c61135f575634c0271a5d</title>
    <updated>2026-10-05T13:12:08Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a234d130e7ad45267a7e</_id>
        <file_type>application/pdf</file_type>
        <flow_id>6ac3a226b242df12a78e3772</flow_id>
        <hash>435c8cf4051624703741971353b1724a834a4ff8055c61135f575634c0271a5d</hash>
        <iocs>
          <emails>
            <value>
              <email>nota.benoitdemaret@gmail.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
          </emails>
          <files>
            <value>
              <SHA-256>8d34ac6464505cdf27a3f2fbfd9df18e5e4ef74101334ceea918f3cc65c2ccbe</SHA-256>
              <SHA-1>93d6010eb80bcfdfef10a72b2c7f0aa645ee8aeb</SHA-1>
              <MD5>9ca45c414a4cf75137ac2f2801328c69</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>90126768ca869f6e0c6ec96c6fd86726d152dbc92f246375776f336050c294fe</SHA-256>
              <SHA-1>0e6e25172081f21de2bd7f3d04b80c5d386f89c1</SHA-1>
              <MD5>ac077402d42a4f82f893815bb9082a05</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>91956a86d3800d719b5e532748a342c60f9c9dab350a030747daa075688ce377</SHA-256>
              <SHA-1>8dc7aec4962964fda347986d638a5e6f4b34ded1</SHA-1>
              <MD5>b3774e7b10a675787900082f9d56137a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>d48a069553b1c81466b108edd47e96c9c572f129784d38ea9b0847b64b022af6</SHA-256>
              <SHA-1>74c54b01c39c9cd6b21d520e0080d9929f684ead</SHA-1>
              <MD5>6215f1fc6e28da25b5f36a3b7f2d5af1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>db4c54c29839a7d6ed9c4970e9e2f066506df7a31125c82e8172243edbe8486b</SHA-256>
              <SHA-1>953feed53ff9c0e688d2fdca8ffdc9d03068de5c</SHA-1>
              <MD5>1677150f706e7890f18907153d5df571</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>ec0a9b9aef618f97f0b00ea60762e0dafbf87ef10bfc03dd76e0b859180152bc</SHA-256>
              <SHA-1>3e331ab1ca12470b89c4194538cd840713d62d4c</SHA-1>
              <MD5>e510524d0315bdeafb3481d120d7bdb3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
          </files>
        </iocs>
        <name>3535-455-1026.pdf</name>
        <report_id>da8472bf-bcd0-436e-88a3-bf216ee4c48b</report_id>
        <tags>
          <value>pdf</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>432bacb1f8513a465f1f00f910b96cf7a0b32e4d0cb083e35b71bb4c198b790f</id>
    <title>Analysis Report for 432bacb1f8513a465f1f00f910b96cf7a0b32e4d0cb083e35b71bb4c198b790f</title>
    <updated>2026-10-05T13:11:23Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a213d130e7ad45267a77</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac3a1faedc8b0d17b0045dd</flow_id>
        <hash>432bacb1f8513a465f1f00f910b96cf7a0b32e4d0cb083e35b71bb4c198b790f</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>869d7e00f43d6029ba72ba8a7819192b91dd81782b900765040c7899446f62fd</SHA-256>
              <SHA-1>65982bb88024b4942b0b1677bf5033e6b061f153</SHA-1>
              <MD5>e24f997c766e63f688a4921a38826e2c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>d7f0783034f134767d7b04a3e93f28b7a8a7caea567c2cbb7fbb9f0f4f4469ab</SHA-256>
              <SHA-1>ec044ae0775e8fb00098b9538b62bede7797791c</SHA-1>
              <MD5>1a2744e6097dc68c4aad2631b6adafed</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>432bacb1f8513a465f1f00f910b96cf7a0b32e4d0cb083e35b71bb4c198b790f.exe</name>
        <report_id>e49aca33-6de7-48c9-90fb-a4f54e16a2d9</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>packed</value>
          <value>anti-debug</value>
          <value>anti-vm</value>
          <value>hacktool</value>
          <value>overlay</value>
          <value>crypto</value>
          <value>reconnaissance</value>
          <value>obfuscated</value>
          <value>microsoft_visual_cc</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>48073427089d9377d50fc3ba69da9ef467d34c27fa8674291129a880fa64b9dc</id>
    <title>Analysis Report for 48073427089d9377d50fc3ba69da9ef467d34c27fa8674291129a880fa64b9dc</title>
    <updated>2026-10-05T13:10:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a1f0d130e7ad45267a6f</_id>
        <file_type>application/vnd.android.package-archive</file_type>
        <flow_id>6ac3a1c431f292eab9b517fd</flow_id>
        <hash>48073427089d9377d50fc3ba69da9ef467d34c27fa8674291129a880fa64b9dc</hash>
        <iocs>
          <urls>
            <value>
              <url>http://ns.adobe.com/xap/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/mm</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/sType/ResourceRef</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>ns.adobe.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <uuids>
            <value>
              <uuid>00ba0edd-f8de-4fb9-b64e-db040f193afd</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>0275e94c-56a7-410f-bd1a-fc7483f7d14a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>07ef0468-4e56-409b-b125-b4e66e7903cc</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>083d8888-6f5d-4e11-9423-87a7509618c8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>0c7870b9-1eb4-4868-9266-d8d80ddc5ca2</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>1131bc65-907c-4d0b-9d1b-bb7268c848d8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>11acd6d8-9090-4455-8e73-350d55ecd2ef</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>12a2f34d-fe68-412c-917e-525bf80711af</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>1500e21f-d0cf-459c-8d15-08913607c75e</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>188e0a1e-6ef8-4e55-be99-b12d083f1abc</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>1b292284-0b4f-4596-b3b0-530b344a324f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>1e5ec3c0-6d48-424b-9c51-77296fa803b7</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>22a1c315-490d-47c0-9308-92ea830449f7</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>25700fea-d5c0-41b9-be90-f7e78247d000</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>29e9084f-bdcd-4da7-88bc-26b3a02696a6</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>2d17c5f2-96eb-45de-b471-bd7c5f874cd2</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>2d9a28ad-dd2c-4223-a3d9-9dc895d807b8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>31aa2902-43ef-4dbb-992c-782ec3ccd3b4</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>33f72542-690c-4d8d-ab04-ca862b2d52e9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>346f01e6-5ac8-4b61-87fa-26346243fb55</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>34ed611c-1531-4dac-b544-f8c3a26388d9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>36cb1004-f109-42cb-b69b-da8c89dbde34</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>3b709562-ae25-452f-9fd2-235eaeb097cf</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>3fdd0271-818b-4783-af3a-8b7ae6359b6b</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>3fe77694-8444-4079-a80c-ef1c5f473c0f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>402d47d7-b374-4b1f-b035-9739031e1313</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>42786f4c-7afb-4442-8803-a5d67dfffce1</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4829ef7a-378d-476a-b457-8fe131f611eb</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>496c1504-9d05-45ee-8b09-2282707fdc76</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a5b2eda-857e-4e52-af58-d4f6f4165a39</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4edab098-4b3d-42a3-a837-5af5459c869a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4fe64add-e216-4f7c-961a-d5a8871981eb</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>50e4834e-5d8f-44de-b627-dd6a8fd7f479</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>533d4a1f-79f3-4abd-987f-7706e1b6aa90</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>537bb4f5-a1be-4657-a3eb-42ea07e6d836</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>5b8ed10c-d034-4e90-ae54-c217d71b8ed9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>5c2826fe-d4b6-4341-97a6-447bf8b8912e</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>610613b9-d52e-407b-a054-51ea57c7fa09</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>615c7fee-3833-4663-9a36-c6941a0b990b</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>61ba4722-2393-4194-a022-35ba2da576b5</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>62ac9b5a-1cbb-45f3-a67f-d2cbc1cf1b16</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>67037c29-bd86-4e2e-9c0c-fe875ed919f4</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>6b12c026-d1a8-4bab-a51e-d175c7a1febf</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>6ed3a798-34b5-4df9-9e01-77e69162e89b</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>71f0754f-c2bd-4ca5-a313-f074bc6193f9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>75577837-089d-4e44-8db1-68a8a140526a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>76b6dc43-ca5e-44c7-af03-e6637862e37a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>7d33adf8-7c78-4a53-81b9-871e922cdb2b</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8141459d-51c1-4cf4-87bf-b4f5ca993283</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>84391d06-db59-49e1-805c-dac13dec9fb9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>85d8770e-9789-4d7c-83c7-1c206a4fdc13</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>885cffe7-976e-41fe-b1ff-8b603c3be6ee</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8b91d3e5-1d11-48d2-8368-380e3cbd64ed</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8f16003b-173a-4127-a843-3af09e5179a3</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>a31e30b7-a1f3-4f8f-b6b5-496c3a2f7092</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>a33cfff3-5678-46f4-8209-fc574e7a6d92</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>a374f43a-bc31-497e-be8d-13eb765e5279</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>b0e8332b-abd4-4c67-aa35-46e033399c8e</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>ba6fa6ae-a30c-4c78-92c5-236325eeca48</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>bac39b5d-406a-449c-94a1-955b98c0566b</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>bf827357-4851-4b86-b385-a7b825af3433</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>c243fca3-3ad4-4458-8d3d-6c64c92c8273</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>c361adbd-7604-4247-84d8-995eee6e9d38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>c4d2094f-3d8e-4dab-a98c-a11985b40e8a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>c4dd0cb5-082c-4fcf-bf4c-a79a1b936ee9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>c66687f5-cb00-4005-8a31-7c17b260ed96</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>c817b511-4e01-4298-a240-49407fc450c6</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>d199b1b5-eb52-4e04-b2e3-deb631936aec</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>dbc53256-e497-47ad-a619-33a37a60b36f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e16b6459-210d-4d82-b23e-f8fb8aa02ad9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e1a2adc5-01b7-42cb-b320-3d32bc307e3f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>eb4231f1-511c-4377-aed0-36a85e058c33</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>ed4b109e-43dc-412c-ad0e-ab476065f8e9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>ee4bad9e-c85f-4351-b26d-48d39373754e</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>ef5ecb43-b41b-4270-9060-8c5226109506</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>f11233e7-0ded-4019-9b4e-59f76072ed79</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>f3b79fa4-45e1-45de-907b-18e30d867baf</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>f595f411-4490-4b84-a3b3-39efc6615ff4</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>f65a0fb5-5ed9-4821-ab3f-523941c1bf50</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>fc9ba60e-e4e6-49fb-8233-62c0eab86d7b</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>ff95ff6a-ac2e-4c15-98b0-6f16387c6056</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>fff19fe1-3479-4bac-b9a0-2fce3e7ba9fb</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>bossSlots.apk</name>
        <report_id>d3f30b1a-5e16-475a-b2fe-3b387c666227</report_id>
        <tags>
          <value>apk</value>
          <value>signed</value>
          <value>bangbang_reinforcement</value>
          <value>obfuscated</value>
          <value>packed</value>
          <value>anti-vm</value>
          <value>base64</value>
          <value>crypto</value>
          <value>evasive</value>
          <value>fingerprint</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>bf1b74ee30e8ad868c9929b3095c497f856d5ac59ea8d5bad9f553c34567f864</id>
    <title>Analysis Report for bf1b74ee30e8ad868c9929b3095c497f856d5ac59ea8d5bad9f553c34567f864</title>
    <updated>2026-10-05T13:10:01Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a1e6d130e7ad45267a6c</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac3a1a731f292eab9b517ca</flow_id>
        <hash>bf1b74ee30e8ad868c9929b3095c497f856d5ac59ea8d5bad9f553c34567f864</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cdn.sucuri.net/sucuri-firewall-block.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://sucuri.net/?utm_source=firewall_block</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://sucuri.net/privacy-policy?utm_source=firewall_block</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://support.sucuri.net/?utm_source=firewall_block</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://uauingleza.com.br/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://uauingleza.com.br/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.sucuri.net/?utm_source=firewall_block</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cutt.ly/FgnPMS</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>cdn.sucuri.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>sucuri.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>support.sucuri.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>uauingleza.com.br</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.sucuri.net</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.13.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.14.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.124.249.108</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.124.249.16</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxps://cutt.ly/FgnPMS</name>
        <report_id>d6a97048-b000-40ec-b9bd-aebb50f47a04</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>173192ec576111adbc0c228f75244cf627513c95ca1709036e9850f0cdb7c90b</id>
    <title>Analysis Report for 173192ec576111adbc0c228f75244cf627513c95ca1709036e9850f0cdb7c90b</title>
    <updated>2026-10-05T13:09:19Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a1a5d130e7ad45267a60</_id>
        <file_type>application/vnd.android.package-archive</file_type>
        <flow_id>6ac3a17db242df12a78e33d8</flow_id>
        <hash>173192ec576111adbc0c228f75244cf627513c95ca1709036e9850f0cdb7c90b</hash>
        <iocs/>
        <name>_cartao protegido.apk</name>
        <report_id>ce9da7b8-74b3-4bd4-922f-b36c7c111a2d</report_id>
        <tags>
          <value>apk</value>
          <value>signed</value>
          <value>expand</value>
          <value>lolbin</value>
          <value>base64</value>
          <value>crypto</value>
          <value>evasive</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d756451fe3e9e00900b85743a9c2ce01cc4f584281a444ca541953122c8ac345</id>
    <title>Analysis Report for d756451fe3e9e00900b85743a9c2ce01cc4f584281a444ca541953122c8ac345</title>
    <updated>2026-10-05T13:08:52Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a19cd130e7ad45267a5c</_id>
        <file_type>image/png</file_type>
        <flow_id>6ac3a16331f292eab9b5174f</flow_id>
        <hash>d756451fe3e9e00900b85743a9c2ce01cc4f584281a444ca541953122c8ac345</hash>
        <iocs/>
        <name>mermaid-diagram.png</name>
        <report_id>43dcf5ce-0957-47bc-acc2-7ec0696bc51e</report_id>
        <tags>
          <value>png</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d5c775cd897e08f667d631d629c2df36ed6da4efff97adb98618684890ec89c8</id>
    <title>Analysis Report for d5c775cd897e08f667d631d629c2df36ed6da4efff97adb98618684890ec89c8</title>
    <updated>2026-10-05T13:08:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a15189017dd18dc1c399</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac3a143b242df12a78e32f6</flow_id>
        <hash>d5c775cd897e08f667d631d629c2df36ed6da4efff97adb98618684890ec89c8</hash>
        <iocs>
          <urls>
            <value>
              <url>paypal.dashboard-manage.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-520/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing?utm_source=errorcode_520&amp;utm_campaign=paypal.dashboard-manage.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://share.google/HizH3aCKGKUHEdAsv</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>developers.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://share.google/HizH3aCKGKUHEdAsv</name>
        <report_id>40d3344f-8ab4-483b-b4df-22afb550c4f4</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>b7ebb627e3531f074fb85553046dd93d522fd1b3c8d996ee91b71084cc79d051</id>
    <title>Analysis Report for b7ebb627e3531f074fb85553046dd93d522fd1b3c8d996ee91b71084cc79d051</title>
    <updated>2026-10-05T13:08:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a17c89017dd18dc1c3a2</_id>
        <file_type>application/vnd.android.package-archive</file_type>
        <flow_id>6ac3a13f31f292eab9b51710</flow_id>
        <hash>b7ebb627e3531f074fb85553046dd93d522fd1b3c8d996ee91b71084cc79d051</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schemas.android.com/apk/res/android</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>schemas.android.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
        </iocs>
        <name>base.apk</name>
        <report_id>011d19a5-a263-4dfb-a769-794f64310c0a</report_id>
        <tags>
          <value>apk</value>
          <value>invalid-signature</value>
          <value>signed</value>
          <value>expand</value>
          <value>lolbin</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>1bd7047740a40e48aff1df37b06ad2c1612e6c50aaaf395a16aed180cf4c296d</id>
    <title>Analysis Report for 1bd7047740a40e48aff1df37b06ad2c1612e6c50aaaf395a16aed180cf4c296d</title>
    <updated>2026-10-05T13:08:16Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a161d130e7ad45267a51</_id>
        <file_type>application/vnd.android.package-archive</file_type>
        <flow_id>6ac3a13db242df12a78e32b1</flow_id>
        <hash>1bd7047740a40e48aff1df37b06ad2c1612e6c50aaaf395a16aed180cf4c296d</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schemas.android.com/apk/res/android</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://android.googlesource.com/toolchain/llvm-project</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>android.googlesource.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schemas.android.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.127.82</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>423fe40f84286ce0005f1b3c5f42a2fc8520b8140e55239af7abfd8b242a972d</SHA-256>
              <SHA-1>b16d8cf6f4382b93ad4d315ccf181633298f6d35</SHA-1>
              <MD5>99d11761f956ff32f4ced49bde95665c</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>Stone Maquininha.apk</name>
        <report_id>5ab2567a-7ae7-4eec-b435-466de134e3af</report_id>
        <tags>
          <value>apk</value>
          <value>html</value>
          <value>signed</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>af3909f5508f9b59ea2e3cf48fb0b9325c6b5c64654c053a1bf06c1782a22496</id>
    <title>Analysis Report for af3909f5508f9b59ea2e3cf48fb0b9325c6b5c64654c053a1bf06c1782a22496</title>
    <updated>2026-10-05T13:08:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a147d130e7ad45267a4b</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac3a13eb242df12a78e32b6</flow_id>
        <hash>af3909f5508f9b59ea2e3cf48fb0b9325c6b5c64654c053a1bf06c1782a22496</hash>
        <iocs>
          <urls>
            <value>
              <url>https://share.google/HizH3aCKGKUHEdAsv</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>paypal.dashboard-manage.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-520/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing?utm_source=errorcode_520&amp;utm_campaign=paypal.dashboard-manage.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>developers.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://share.google/HizH3aCKGKUHEdAsv</name>
        <report_id>ce0f2a70-5cab-4a9c-be0e-aa5c27d07b58</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>050b38c87f55129f1c39af218851cfb9f03a068ab6a072d844dbffdeef32bbc8</id>
    <title>Analysis Report for 050b38c87f55129f1c39af218851cfb9f03a068ab6a072d844dbffdeef32bbc8</title>
    <updated>2026-10-05T13:07:42Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a131d130e7ad45267a46</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac3a11cb242df12a78e3218</flow_id>
        <hash>050b38c87f55129f1c39af218851cfb9f03a068ab6a072d844dbffdeef32bbc8</hash>
        <iocs>
          <urls>
            <value>
              <url>https://borderxnation.com:443</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>borderxnation.com</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.21.14.172</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>199cdbbdd8003a93f1901774ea9b55cfe05bc42c0de488cae3dec9033f5e2b8d</SHA-256>
              <SHA-1>74cf6c5a8b5929d7fafa30d6cdfd70a22ca2a622</SHA-1>
              <MD5>8937388e409306592d6717ff26fb8902</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>24aed8cd9dd33430708708fbffc0d9db5e6c3564b2146768ae7a875cb1cfbc2e</SHA-256>
              <SHA-1>e3e08d1d929abf9a8d36e12c6ed22dabf796380b</SHA-1>
              <MD5>086edb5f6c36a34b4f6f6debe3ea4bb8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>48d525c2ba3677f2a6c5091ae1f49b5801b62b1410617476a43b0eb49f3b9fd1</SHA-256>
              <SHA-1>7fc91b484610e7bdaf42d98cc8ba682a62b1ebf3</SHA-1>
              <MD5>abafcec6badd861dae997034739df3e4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>4ff1c75a93b2280dabe75acecade82d644388c9f4412565d846aeb396bfdc133</SHA-256>
              <SHA-1>6a55e1445c1c915664fba385828c5a0078fe460d</SHA-1>
              <MD5>f3d7095de1636559aa56ad81b25bbff9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>6ad9d2a4ce0bfec38454a93a896d1bc0a20df9f884059a502ac0a51b0f7ade9b</SHA-256>
              <SHA-1>4c52b4caf7f31a63860ff3f648456739abbc15f2</SHA-1>
              <MD5>9d8bbe6ef2116ed1cf2f36b31cceff51</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>9a14ffe356eb7ff73b4da61f8402bde3823a877227d5ab68ac569bc68df84396</SHA-256>
              <SHA-1>961fa5d9c84f56615aa1c4b492aedfcc226e7438</SHA-1>
              <MD5>9f3b4acfbd96a9f79e34116b9617915a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>a1f04c0ff3f00624286a084aa5f8acfd4fc6fa81de5cb54f5a1cbaff2f865320</SHA-256>
              <SHA-1>b91e7605d5ffb4ce68fc7582bf38f951889a9228</SHA-1>
              <MD5>de9434b651affc51661d88045d31eeac</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>ac35ad07fd04afd83957afbb93fd07a3b28845b44868d360bc44c3691d2e2a17</SHA-256>
              <SHA-1>7d6ab23ab1ad400caa6101717d672e7f765df239</SHA-1>
              <MD5>1100a17a9eb2346496cb8cf2ecf8704b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>d92e9af9c6c038f4da559e0ac30efc0427fa6915bf19efbd1fa05e5f2d8053ec</SHA-256>
              <SHA-1>1ebe62b065bfa230e0041ae850694c99e413f0e3</SHA-1>
              <MD5>f573e81dc7154adc71a17e8f9db3f3d0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>ddede0123042d7c2cb04fef5b97681305b96cb82090bd1542c34f65bd6fa958a</SHA-256>
              <SHA-1>cb65124f82054a26c36479436ef2eccce16d9236</SHA-1>
              <MD5>0e1fa9c5c3ffa6af1f61acdd1f6646f2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>eae9a65b090d08f80a28849db1265ff641cb2bfcbdaf1e83be0547c44ad5b1f3</SHA-256>
              <SHA-1>24720384c767e9084cd55a12cb6bd39f072ce9bd</SHA-1>
              <MD5>cf1a3fb00947dc25a5262b066f06e422</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>fa33db1a55a9917cb6e055330f51f8a3417fef815774fa5f45f7c288b4d9fe1c</SHA-256>
              <SHA-1>d1443fcbbf878b01303a6ccf228895a69d52fea5</SHA-1>
              <MD5>5f9cfdb51f1b6f9f34cd22ae002865f6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>4a7123daedcf67060632dfec50eb9253716c90d35dd05bca85999f1e46345691</SHA-256>
              <SHA-1>a46eed48691c3765c05a00e89cc2f6b761e5d898</SHA-1>
              <MD5>5434ef5edb896f05f7f7b7c61c7dbffb</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\</registry>
              <origin>DOTNET_DECOMPILATION</origin>
            </value>
          </registry>
        </iocs>
        <name>borderxnation.com</name>
        <report_id>1e793d4b-2044-4437-814a-790e2682333e</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>dotnet_pe</value>
          <value>asyncrat</value>
          <value>config-extracted</value>
          <value>remoteaccesstool</value>
          <value>anti-vm</value>
          <value>fingerprint</value>
          <value>base64</value>
          <value>masquerade</value>
          <value>reconnaissance</value>
          <value>lolbin</value>
          <value>schtasks</value>
          <value>obfuscated</value>
          <value>vbnet</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>5e1146545298f3026c341a12811c2827541218f930e83104962c69bc3511277b</id>
    <title>Analysis Report for 5e1146545298f3026c341a12811c2827541218f930e83104962c69bc3511277b</title>
    <updated>2026-10-05T13:07:39Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a12dd130e7ad45267a45</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac3a119b242df12a78e31fd</flow_id>
        <hash>5e1146545298f3026c341a12811c2827541218f930e83104962c69bc3511277b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://drive.usercontent.google.com/download?id=1GYn17A1iG0hd3SbITYiBz2f4g6YvyhyA&amp;export=download</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ssl.gstatic.com/docs/doclist/images/drive_favicon_2026_32dp.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://drive.google.com/uc?export=download&amp;id=1GYn17A1iG0hd3SbITYiBz2f4g6YvyhyA</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://drive.usercontent.google.com/download</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>drive.usercontent.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>drive.usercontent.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ssl.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.110.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.132</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.132</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>c31a76a9d09ef83fe37536b145f111869089507c668f8a8a1efdb56ca6e09ba7</SHA-256>
              <SHA-1>fbb202f9bc9765016acedb9095fb2cbb3d1a7ff7</SHA-1>
              <MD5>79339d805930386982965ef306f8631f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://drive.google.com/uc?export=download&amp;id=1GYn17A1iG0hd3SbITYiBz2f4g6YvyhyA</name>
        <report_id>00f4e45a-aa41-4a0f-a126-5f5cd7f5fd7d</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>UNKNOWN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>767eac76f5e3a3121766e4430728bb8bbde78eb3a21c6b795795f4c7a79d5725</id>
    <title>Analysis Report for 767eac76f5e3a3121766e4430728bb8bbde78eb3a21c6b795795f4c7a79d5725</title>
    <updated>2026-10-05T13:06:24Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a0fad130e7ad45267a3b</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac3a0cf7e4998b7d6180e7a</flow_id>
        <hash>767eac76f5e3a3121766e4430728bb8bbde78eb3a21c6b795795f4c7a79d5725</hash>
        <iocs>
          <urls>
            <value>
              <url>https://us-as.gr-cdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/images/core/global/default/icons/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/UnsubscribePage.6496d7d8686bea0c4758.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/UnsubscribePage.6496d7d8686bea0c4758.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/common.d2d31deeba74b41e3934.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/common.d2d31deeba74b41e3934.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/common~ConfirmPage~SmsUnsubscribePage~UnsubscribePage.05eb0b996107009dbf22.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/common~ConfirmPage~UnsubscribePage.400c252693acb3076b90.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/common~SmsUnsubscribePage~UnsubscribePage.fafa63adac5c74448661.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/runtime.bundle.afd4904944e61b07410e.sjs.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/vendor.216bfab55d373cc57cdb.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://api.vitally-eu.io/analytics/v1/account</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://api.vitally-eu.io/analytics/v1/user</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://api2.amplitude.com/2/httpapi</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.amplitude.com/libs/analytics-browser-gtm-2.42.5-min.js.gz</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.amplitude.com/libs/analytics-browser-gtm-wrapper-2.42.5.min.js.br</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.vitally-eu.io/vitally.js/v1/vitally.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://dev.visualwebsiteoptimizer.com/j.php</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://dev.visualwebsiteoptimizer.com/j.php?a=4859&amp;u=https%3A%2F%2Fmail.alerabat.com%2Funsubscribe%2F%3Fx%3Da62e%26co%3DBrqM%26m%3DMc%26mc%3DD%26s%3DBSqj%26u%3D4%26z%3DFD996jG&amp;r=0.772601502678169</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fast.appcues.com/82114.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fast.appcues.com/generic/main/7.31.11/appcues.main.aa74ad4c8cd44dde258c99747b6bfab1ee56118d.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fast.appcues.com/generic/main/7.31.11/container.aa74ad4c8cd44dde258c99747b6bfab1ee56118d.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mail.alerabat.com/unsubscribe/?x=a62e&amp;co=BrqM&amp;m=Mc&amp;mc=D&amp;s=BSqj&amp;u=4&amp;z=FD996jG</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://o566338.ingest.sentry.io/api/5879227/envelope/?sentry_key=2bda043d72f346ce8439c54d77fe5384&amp;sentry_version=7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://p.typekit.net/p.css?s=1&amp;k=ytb2blj&amp;ht=tk&amp;f=15705.15708&amp;a=7949409&amp;app=typekit&amp;e=css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://sr-client-cfg.amplitude.com/config/53abdbba6458574bc2e9579a5fda0e6c?config_group=browser</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/images/core/global/default/icons/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/11.2b0d846127eb1b4e7a7f.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/UnsubscribePage.6496d7d8686bea0c4758.min.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/UnsubscribePage.6496d7d8686bea0c4758.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/b2a6341ae7440130ec4b4b186aff8413.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/common.d2d31deeba74b41e3934.min.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/common.d2d31deeba74b41e3934.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/common~ConfirmPage~SmsUnsubscribePage~UnsubscribePage.05eb0b996107009dbf22.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/common~ConfirmPage~UnsubscribePage.400c252693acb3076b90.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/common~SmsUnsubscribePage~UnsubscribePage.fafa63adac5c74448661.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/e53bad2f54459c134a9209bc5a092983.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/edfad84f0a16839da992860049379232.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/runtime.bundle.afd4904944e61b07410e.sjs.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://us-as.gr-cdn.com/javascripts/app-frontend-subscriber-pages/dist/vendor.216bfab55d373cc57cdb.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://use.typekit.net/ytb2blj.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.getresponse.com?lang=pl</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=GTM-KZ3DSPX</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://mail.alerabat.com/unsubscribe/?x=a62e&amp;co=BrqM&amp;m=Mc&amp;mc=D&amp;s=BSqj&amp;u=4&amp;z=FD996jG&amp;r=0.772601502678169</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://mail.alerabat.com/unsubscribe.html?x=a62e&amp;co=BrqM&amp;m=Mc&amp;mc=D&amp;s=BSqj&amp;u=4&amp;z=FD996jG&amp;</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>us-as.gr-cdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>api.vitally-eu.io</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>api2.amplitude.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cdn.amplitude.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cdn.vitally-eu.io</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>dev.visualwebsiteoptimizer.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fast.appcues.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mail.alerabat.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>o566338.ingest.sentry.io</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>p.typekit.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>sr-client-cfg.amplitude.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>us-as.gr-cdn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>use.typekit.net</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>www.getresponse.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>m...@gmail.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>13.32.121.75</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>143.204.181.8</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>146.75.122.137</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>16.192.53.36</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>18.245.86.111</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>184.24.77.160</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>184.24.77.169</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>185.111.111.158</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>32.186.10.74</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>34.107.218.251</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>34.160.81.0</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>91.239.185.14</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>185.111.111.158</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>8aa61143e26de953f322e49adfcde548bd03af0e8dade8bc28a67dab1bdb70a8</SHA-256>
              <SHA-1>6e6622e3ee792bd3137e49cfb00b3be53c3ccaf5</SHA-1>
              <MD5>ddded22f6c44ef8a4df19239d1b64d70</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>3eb4910440bf37ffbc06ff508609af8c5e933f283cd0b894a0fb4c3a1b7fbccd</SHA-256>
              <SHA-1>496b21013d50efaca2e17af4dfbbea3326a014a7</SHA-1>
              <MD5>eae862fb0f116982c41569da61ffb40e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/css</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>786684f5e186fbfdf1ad662efb5a687922ca33da148b0e0f5d3bb85c51401cf5</SHA-256>
              <SHA-1>77fbe5cb9a250d95737859355adef71275a1b9b0</SHA-1>
              <MD5>96fd7953a5c3a0b887f8e859f54cf250</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/css</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>25fb23868ebf48348f9e438e00cb9b9d9b3a054f32482a781c762cc4f9cc6393</SHA-256>
              <SHA-1>0004d4f82b546013424b2e0de084395071eef98b</SHA-1>
              <MD5>4b074b0b59693fa9f94fb71b175fb187</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>c32a0c3f3cafa637e2e739d020027340225388a5f97d12565babd118dd810c8a</SHA-256>
              <SHA-1>f51476ef0821ea9d304d887553a5416593413f62</SHA-1>
              <MD5>07e2c14df9b8e98b6431dc0dfba8b354</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>f64af2e9c7322b833be2c4d9170db12bb3826cb929dd900039308643e008aea8</SHA-256>
              <SHA-1>e8e734ee787db3f6fa418fec18b5c857fcafde79</SHA-1>
              <MD5>19f3e75de20dd65d1e26d5b3ba5e2dd5</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>7e05fe57dac9f66c63c3a1cc1b49635f3323637e3f54ce82cd2a0542818f4d93</SHA-256>
              <SHA-1>e6e95fedfd3324686ad065bf42e3eb7ac89bb4b7</SHA-1>
              <MD5>6dfeb808fb570409166a3fe5d52776c8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>387d2d2660adca97883a62714ccfaf0b0a9460b024c14e091292c00835c85cd9</SHA-256>
              <SHA-1>62b269752cd9c85234fa918547253e0d665286f8</SHA-1>
              <MD5>0f016f1d819b818808b206ad01488f70</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>14a09a8370375815839497441ef535169ded8ca40ca2fa8339e1fe0008168cea</SHA-256>
              <SHA-1>5d87aba079da5e1a2c0f8b90021674a41a35cf30</SHA-1>
              <MD5>3ae4881afb597c968d0be84c5f0b9503</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://mail.alerabat.com/unsubscribe.html?x=a62e&amp;co=BrqM&amp;m=Mc&amp;mc=D&amp;s=BSqj&amp;u=4&amp;z=FD996jG&amp;</name>
        <report_id>9a782f0f-223d-412e-8ca4-6b5ed07166c6</report_id>
        <tags>
          <value>html</value>
          <value>javascript</value>
          <value>txt</value>
          <value>obfuscated</value>
          <value>base64</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>cf93705ba9ee3d7e33503b7b54e2fcc8c93b72abaab20f17a548f68f0399444a</id>
    <title>Analysis Report for cf93705ba9ee3d7e33503b7b54e2fcc8c93b72abaab20f17a548f68f0399444a</title>
    <updated>2026-10-05T13:04:23Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a0e0d130e7ad45267a35</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6ac3a055b242df12a78e2e82</flow_id>
        <hash>cf93705ba9ee3d7e33503b7b54e2fcc8c93b72abaab20f17a548f68f0399444a</hash>
        <iocs>
          <urls>
            <value>
              <url>file:///tmp/tmpq8bp1qaf.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aka.ms/LearnAboutSenderIdentification</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.opswat.com%2Fsolutions%2Femail-security&amp;data=05%7C02%7Ctim.wikander%40opswat.com%7C1c0d37aa394d40bff68c08df22dcdfce%7C58122277edf8404896c4ec80d30669b8%7C0%7C0%7C639268004340650872%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C40000%7C%7C%7C&amp;sdata=W1EYGaV5UQaPrf4SmFzFmwZA75jiiXgn5ZS96uKmnzI%3D&amp;reserved=0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:quotes%40unileversupplies.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:rfq%40equipkits.xyz</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.opswat.com/solutions/email-security&amp;data=05</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>opswat.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aka.ms/LearnAboutSenderIdentification</url>
              <origin>EMAIL_BODY</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.opswat.com%2Fsolutions%2Femail-security&amp;data=05%7C02%7Ctim.wikander%40opswat.com%7C1c0d37aa394d40bff68c08df22dcdfce%7C58122277edf8404896c4ec80d30669b8%7C0%7C0%7C639268004340650872%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C40000%7C%7C%7C&amp;sdata=W1EYGaV5UQaPrf4SmFzFmwZA75jiiXgn5ZS96uKmnzI%3D&amp;reserved=0.</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.opswat.com/solutions/email-security&amp;data=05</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>opswat.com</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>https://aka.ms/LearnAboutSenderIdentification</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://aka.ms/LearnAboutSenderIde</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://aka.ms/LearnAboutSenderIdentification</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.opswat.com%2Fsolutions%2Femail-security&amp;data=05%7C02%7Ctim.wikander%40opswat.com%7C1c0d37aa394d40bff68c08df22dcdfce%7C58122277edf8404896c4ec80d30669b8%7C0%7C0%7C639268004340650872%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C40000%7C%7C%7C&amp;sdata=W1EYGaV5UQaPrf4SmFzFmwZA75jiiXgn5ZS96uKmnzI%3D&amp;reserved=0.</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.opswat.com/solutions/email-security&amp;data=05</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>opswat.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>aka.ms</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>aka.ms</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>nam04.safelinks.protection.outlook.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>aka.ms</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>nam04.safelinks.protection.outlook.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>aka.ms</url>
              <origin>INPUT_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>aka.ms</url>
              <origin>EMAIL_BODY</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>nam04.safelinks.protection.outlook.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>02fb077def2cf2d94ec5e11547104b9c@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>0a6969c51cfd2a5c630b78322773d123@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>14799b168e0680b9b97812c3b00dd4c3@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>15891560795dacde328049334ae5bc3e@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>167f52a5251501585747e1790c9ef70a@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>181d999ab95c894813862aea6b51ee16@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>1bd7ddc014ba50e1a464f102fd850005@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>21d254d294fa8849b0220f6e113ac910@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>235c2ef628113160d1eabc70acd8340c@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>250db011f88d9b00df11224d51fb809b@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>253f5d00ab0cf10e748be752e63dd845@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>264669956244c6f7d2f57ac0cd0d2d6e@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>26dc7bbc72fbe5c303a0a381a0cff818@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>2f971248cd9bef70150ee99b00b6dc20@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>3020d89484c9bb0d6cc88e06eb41615a@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>33240014a8b8b831682b2a429c303bac@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>381f5e0eab002e924b91f4f694a2d061@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>383b4be19bd1e5381e2ff5f9449154ff@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>3b51a16543c5ae8243d3fd2c33a3057a@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>3c5b84a985dc87a476b4aa0f447154ad@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>3efc978a46f06ea7a5d51b8f43609c66@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>45b6a3fc62fb9fa4b129a99431ef7f63@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>4a0ad5161522e5d654179eb0562e0ffa@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>4a3ca9fbe5550a2287591ac055ea23ab@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>4d708d63e3ca760dc43866b8ac0d7e86@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>5705a5e5e9152ca5f32adc36f78c63a5@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>576d1b1951ffcf1a84e1ae1666aa53ef@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>59b66892d171bbedaed8d938b1e00b14@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>5fa48e892e12209a2e416885a08a771f@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>611e0998a1b9512ce6b8c12af6f34568@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>68d193427943aa9a45f24b893e7dcdd3@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>68ebe848f0245cc2f44e4e2ae5e95d7a@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>6b2048785fdee89e6795426ce9a41608@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>77e3c2cfd251b4567ecf44047f5c967c@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>7b430841c39b03fecdc8def4863324a1@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>7c4d438f311d6324280a125d0fdf32cc@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>810933ac149be0cde8dac368fd7dddbc@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>841c39b03fecdc8def4863324a1@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>88d85b5d8a8b362a72c73f39aea37cb0@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>8c51fd29845d5ea16d7a05dbe6c75be4@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>9569df46783d156e33e9f1090deef142@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>9cdb21528ead8e8e6403fb87a47fa177@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>9ed086008fffb507eb4e19f47b913c94@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>a1d596f001e49fe5c6c58d28ba42276b@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>aca941f1eb0e8c40cadef6518411c083@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>b27d151f1e21581df3302a1e239f06a7@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>be32c84838bdd5551432b60aa4239538@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>c5ae689bd1fc12901fd515d54269f2de@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>c69abb049766084c5e25a2dd4823118f@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>c91c3cdae057bdc98a5919ff7244b9b8@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>c964cd1e0e22b982e7e89542f5e7da10@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>d297df6556cf8f5859c514e549d17220@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>d60434a6192b4ce797fef0c8991ef327@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>daef11cc76baea1f9041ee240df66f41@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>db199b8801fbaf68005108b8ed4b2876@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>e298f048afe3a4fac0e580bf953051db@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>e45a59ef40e4170f21f90d23a87b1313@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>e9d4780b342a01c7338f1a9377ac6ba0@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>eac403fa18843d9ea55aee3f9150b3a1@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>ece45d2b90487fe725eb3f7316548b39@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>edc1a88d2961460494dcee5ea705e4f1@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>f1ca5da93eda0b76ab87c019a416b28@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>fc31583aa61fc97d6618d51d5cccf74d@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>quotes@unileversupplies.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>rfq@equipkits.xyz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>quotes@unileversupplies.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>quotes@unileversupplies.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>rfq@equipkits.xyz</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>quotes@unileversupplies.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>rfq@equipkits.xyz</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>rfq@equipkits.xyz</email>
              <origin>CONTENT_PARSE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>2.23.246.9</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>10.1.24.53</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>10.167.244.187</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>10.167.248.139</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>105.116.13.124</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>54.69.214.246</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>66.29.132.245</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>52.102.113.10</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>3426d4f34b2869ec93366262279f256a260d87e5f76a3e065a35fb85d2033650</SHA-256>
              <SHA-1>98ae2177f11d16cb2b8b0015f8b0cedb307ea4f1</SHA-1>
              <MD5>c160de92ce9ba3af7503abc1177cf861</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>92cb7b1632cb8432de26d88f0c54657d3ac58332df7a8c9b5df1cd4afb3b7399</SHA-256>
              <SHA-1>370f29feffc33793aadd7109f70f099f8075441c</SHA-1>
              <MD5>48cb16f1289fdca1a530393d63795e8e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>dde045e173fc6e4e2c109d8678a4b5440f7d0807baa18e1cfb907f004bae8eb3</SHA-256>
              <SHA-1>6c2aea9e7fbd6a69b2e0a7365cd71fa41fc1941e</SHA-1>
              <MD5>1a984e88c15ab52f94d67d0df2c4fddb</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/pdf</file_type>
            </value>
            <value>
              <SHA-256>e98f32361df6dbf77f79493d5a2e7ea85fe15007bb5e3adf3f3c3675b860af58</SHA-256>
              <SHA-1>f12c0f084948736445461542294a2ecfc89a39a4</SHA-1>
              <MD5>a41be97b34c06210dbecaf2f9e0145dc</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>f8b0400f0dd71a47e5187a8dea82ea655379a3ba6466e8c9fd8f17b35db5a611</SHA-256>
              <SHA-1>844f04c45b6f4933b401acd0c9daaa24976a373e</SHA-1>
              <MD5>7336cf5316e4f5ec6b4db26c50a31ed3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>453e412cb98c53819c67e706efa1eee4b1af066db38024c8a842e18f552e75ca</SHA-256>
              <SHA-1>8ab0df5e8824e921343573fa369348ca540b3494</SHA-1>
              <MD5>011ddf534a9de925cafc0d756f196b80</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/x-ini</file_type>
            </value>
            <value>
              <SHA-256>f809dae7b8ee0f4152d293c09c5d4d4fae874bf7bbca7424a015cdc6bfba8501</SHA-256>
              <SHA-1>e830828998a692a5f648f1300fe9fba4137cf62f</SHA-1>
              <MD5>5059b6f004750c4b8eaaeec05beded66</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>9259b3cfea24b49c0e8f5ebeb5fa5d14f55b7863263e743ccad4b0693b1537a7</SHA-256>
              <SHA-1>8aabd7c9eb816dbb9a86de3e1598b1ee2045d0f7</SHA-1>
              <MD5>02658f171648e8da3c713d9c5c042158</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>0a4783979c55c54467d0617ab8a17389b5f08ff09f8f21a3500f34237f23156b</SHA-256>
              <SHA-1>526dd5d5c34adebdbef5b78001bff736748e41b3</SHA-1>
              <MD5>bf7ddc3a3bf34172fe2af39142c4c2e1</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>20a055f889a0f373f6ce3a5946941e3200cc9cfa6628f82de0978e20c90eccc8</SHA-256>
              <SHA-1>fe26b29330568ec9ce7d6dfc989ca4418d29e791</SHA-1>
              <MD5>4666120db574118975fe598c9ce8d767</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>7c41b898c5da0cfa4aa049b65ef50248bce9a72d24bef4c723786431921b75aa</SHA-256>
              <SHA-1>10588307553e766ab3c7d328d948dc6754893cef</SHA-1>
              <MD5>825644f747baab2c00e420dbbc39e4b3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>98229587907787192b739026101c93146edc82ed3d7a5d0c4878b29f7e789ab6</SHA-256>
              <SHA-1>736d2cf47af1489f2fca121993fdd79f6f1e57e5</SHA-1>
              <MD5>e07e2fd77ad7b35963fef14f5057d26a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1c0d37aa-394d-40bf-f68c-08df22dcdfce</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>58122277-edf8-4048-96c4-ec80d30669b8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>7f895569-0c5e-4528-b229-08df22dccf3d</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>SUPPLY.eml</name>
        <report_id>7ff40d38-c9ea-471a-a0a4-151960433662</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
          <value>html</value>
          <value>xml</value>
          <value>txt</value>
          <value>aidetect</value>
          <value>phishing</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>1a53be42e3bb5daa658eac29b1df3568bbdd3f294d4a495f9f09c0e9d0e361c8</id>
    <title>Analysis Report for 1a53be42e3bb5daa658eac29b1df3568bbdd3f294d4a495f9f09c0e9d0e361c8</title>
    <updated>2026-10-05T13:03:56Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a07ed130e7ad45267a1b</_id>
        <file_type>text/x-python</file_type>
        <flow_id>6ac3a03ab242df12a78e2dcd</flow_id>
        <hash>1a53be42e3bb5daa658eac29b1df3568bbdd3f294d4a495f9f09c0e9d0e361c8</hash>
        <iocs/>
        <name>__init__.py</name>
        <report_id>2ed8c0fb-17d3-4416-9c4e-dd799ad17aa4</report_id>
        <tags>
          <value>python</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>3ecf5a9d80484bec73eef67e54c7d7e2880c726e4bfac58d05b1a14b6e1988ce</id>
    <title>Analysis Report for 3ecf5a9d80484bec73eef67e54c7d7e2880c726e4bfac58d05b1a14b6e1988ce</title>
    <updated>2026-10-05T13:03:56Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a080d130e7ad45267a1e</_id>
        <file_type>text/x-python</file_type>
        <flow_id>6ac3a03ab242df12a78e2dcd</flow_id>
        <hash>3ecf5a9d80484bec73eef67e54c7d7e2880c726e4bfac58d05b1a14b6e1988ce</hash>
        <iocs/>
        <name>memory_manager.py</name>
        <report_id>bc1d33df-1be8-4be6-ad0d-802d3f63e97d</report_id>
        <tags>
          <value>python</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>5fadefd3b6ca3d6dd3aefdd4d501da9cb44f9581313c4b2e2334f400730fc749</id>
    <title>Analysis Report for 5fadefd3b6ca3d6dd3aefdd4d501da9cb44f9581313c4b2e2334f400730fc749</title>
    <updated>2026-10-05T13:03:56Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a09ed130e7ad45267a27</_id>
        <file_type>text/x-python</file_type>
        <flow_id>6ac3a03ab242df12a78e2dcd</flow_id>
        <hash>5fadefd3b6ca3d6dd3aefdd4d501da9cb44f9581313c4b2e2334f400730fc749</hash>
        <iocs>
          <urls>
            <value>
              <url>http://www.apple.com/DTDs/PropertyList-1.0.dtd</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>http://www.apple.com/DTDs/PropertyList-1.0.dtd</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>apple.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>apple.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>17.253.144.10</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>ddb17d259447b422d85da3a545288adb696d499fd0080223cf8b3642e4630b2f</SHA-256>
              <SHA-1>0fb797d943161882753d755df20ac778befec2d1</SHA-1>
              <MD5>377db9a37a858df8ea2e06a27d0e4f1a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xml-dtd</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>B4BFCC3A-DB2C-424C-B029-7FE99A87C641</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>B4BFCC3A-DB2C-424C-B029-7FE99A87C641</uuid>
              <origin>CONTENT_PARSE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Run</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion</registry>
              <origin>CONTENT_PARSE</origin>
            </value>
          </registry>
        </iocs>
        <name>ui.py</name>
        <report_id>21f53c01-5f9f-4e5b-9dea-682beb30e31f</report_id>
        <tags>
          <value>python</value>
          <value>wscript</value>
          <value>finger</value>
          <value>lolbin</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>c0d70adf085e5f9f9486f0631c68c6ffce6967a1bb619794f914131176ef6906</id>
    <title>Analysis Report for c0d70adf085e5f9f9486f0631c68c6ffce6967a1bb619794f914131176ef6906</title>
    <updated>2026-10-05T13:03:56Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a07bd130e7ad45267a16</_id>
        <file_type>text/x-python</file_type>
        <flow_id>6ac3a03ab242df12a78e2dcd</flow_id>
        <hash>c0d70adf085e5f9f9486f0631c68c6ffce6967a1bb619794f914131176ef6906</hash>
        <iocs/>
        <name>setup.py</name>
        <report_id>57d63a7b-bd07-4e20-b515-83ae2a06151e</report_id>
        <tags>
          <value>python</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>dc9d8aa321decfa556aa8d1a4e937b78b63ed8c2e60795fce8608b463aebaf5d</id>
    <title>Analysis Report for dc9d8aa321decfa556aa8d1a4e937b78b63ed8c2e60795fce8608b463aebaf5d</title>
    <updated>2026-10-05T13:03:56Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a0b6d130e7ad45267a2d</_id>
        <file_type>text/markdown</file_type>
        <flow_id>6ac3a03ab242df12a78e2dcd</flow_id>
        <hash>dc9d8aa321decfa556aa8d1a4e937b78b63ed8c2e60795fce8608b463aebaf5d</hash>
        <iocs>
          <urls>
            <value>
              <url>https://aistudio.google.com/app/apikey)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://creativecommons.org/licenses/by-nc/4.0/)**.</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://github.com/FatihMakes/Mark-LIV.git</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/google-ai-edge/mediapipe)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/fatihmakes)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/@FatihMakes)</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/@FatihMakes)**</url>
              <origin>INPUT_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://aistudio.google.com/app/apikey</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://creativecommons.org/licenses/by-nc/4.0/)**.</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://github.com/FatihMakes/Mark-LIV.git</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>https://github.com/google-ai-edge/mediapipe</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/fatihmakes</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/@FatihMakes</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/@FatihMakes)**</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>aistudio.google.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>creativecommons.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>github.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>instagram.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>youtube.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>aistudio.google.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>creativecommons.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>github.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>instagram.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>youtube.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.14.190</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>57.144.244.34</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.20.5.134</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.121.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>9aeb4200344f4fe1204f68a91908ffb2693e5cfff57f6c4ed98ec7e120d41f1f</SHA-256>
              <SHA-1>e57ce011572307edb422ff05c3a41160998b6b67</SHA-1>
              <MD5>99e25ff20f87ac795b6a706db90d7eac</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>9e278761d3fdac6fbca0197ff7ca7af5a69cbccd5e729b05054bb3df30149210</SHA-256>
              <SHA-1>509992dce9e34ec2f85947f4bd4ab30821c90256</SHA-1>
              <MD5>97ed853ce566c99d54b87f2cc942a4ca</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>67d092007811d0f56ad8455ba56a78d015bf374aa3ec795ace17a25d9a72382b</SHA-256>
              <SHA-1>d1af7e0568ef31f8cac7ef4adebe7f6a259d9fa8</SHA-1>
              <MD5>63dd0bd87670c8f9ce67aa179e2a10e3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>c719bc7aff10e35caa55d114fba3afb0b4ce5645b34d4aed6895a42cff33af15</SHA-256>
              <SHA-1>3e2447c5cfa8b5e722e68536ee72974a3a8ca10b</SHA-1>
              <MD5>17fa179364a316bda071667e49084758</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>da453511f48587c193f03578187d09a2e0197ebc9b88d52eecf56c82e5a2bfc5</SHA-256>
              <SHA-1>734ba8342ac871e091b669001622ac89ae19b8a6</SHA-1>
              <MD5>2b079c4806cff23cf9039cbbf718d878</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>d4cdc1d221c58c708dca2671e7fe7631f7a8ad643ff6009f4d4861690758d0ef</SHA-256>
              <SHA-1>8a69b60fd445e49c708dd33cf4dbb674ebf04a06</SHA-1>
              <MD5>6172e6e766c1e7c922eeb13abc81efdf</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>readme.md</name>
        <report_id>965a36f8-d1a9-4b86-9ef6-e230228eca83</report_id>
        <tags>
          <value>txt</value>
          <value>html</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>dde045e173fc6e4e2c109d8678a4b5440f7d0807baa18e1cfb907f004bae8eb3</id>
    <title>Analysis Report for dde045e173fc6e4e2c109d8678a4b5440f7d0807baa18e1cfb907f004bae8eb3</title>
    <updated>2026-10-05T13:03:49Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a095d130e7ad45267a25</_id>
        <file_type>application/pdf</file_type>
        <flow_id>6ac3a03331f292eab9b514e2</flow_id>
        <hash>dde045e173fc6e4e2c109d8678a4b5440f7d0807baa18e1cfb907f004bae8eb3</hash>
        <iocs>
          <emails>
            <value>
              <email>quotes@unileversupplies.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
          </emails>
          <files>
            <value>
              <SHA-256>3426d4f34b2869ec93366262279f256a260d87e5f76a3e065a35fb85d2033650</SHA-256>
              <SHA-1>98ae2177f11d16cb2b8b0015f8b0cedb307ea4f1</SHA-1>
              <MD5>c160de92ce9ba3af7503abc1177cf861</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>92cb7b1632cb8432de26d88f0c54657d3ac58332df7a8c9b5df1cd4afb3b7399</SHA-256>
              <SHA-1>370f29feffc33793aadd7109f70f099f8075441c</SHA-1>
              <MD5>48cb16f1289fdca1a530393d63795e8e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>e98f32361df6dbf77f79493d5a2e7ea85fe15007bb5e3adf3f3c3675b860af58</SHA-256>
              <SHA-1>f12c0f084948736445461542294a2ecfc89a39a4</SHA-1>
              <MD5>a41be97b34c06210dbecaf2f9e0145dc</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>f8b0400f0dd71a47e5187a8dea82ea655379a3ba6466e8c9fd8f17b35db5a611</SHA-256>
              <SHA-1>844f04c45b6f4933b401acd0c9daaa24976a373e</SHA-1>
              <MD5>7336cf5316e4f5ec6b4db26c50a31ed3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
          </files>
        </iocs>
        <name>RFQ-1_sanitized.pdf</name>
        <report_id>384685ed-4cbe-40a4-9a02-ff922c5a1c04</report_id>
        <tags>
          <value>pdf</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855</id>
    <title>Analysis Report for e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855</title>
    <updated>2026-10-05T13:03:27Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a027d130e7ad45267a02</_id>
        <file_type>application/octet-stream</file_type>
        <flow_id>6ac3a01cb242df12a78e2d27</flow_id>
        <hash>e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855</hash>
        <iocs/>
        <name>$BadClus</name>
        <report_id>f76c1a26-e65b-4095-aa8c-bbcc1c06dc83</report_id>
        <tags>
          <value>data</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855</id>
    <title>Analysis Report for e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855</title>
    <updated>2026-10-05T13:03:27Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a026d130e7ad45267a01</_id>
        <file_type>application/octet-stream</file_type>
        <flow_id>6ac3a01cb242df12a78e2d27</flow_id>
        <hash>e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855</hash>
        <iocs/>
        <name>$Secure</name>
        <report_id>1f361de3-86b3-4798-b1c5-f8b51261cfe7</report_id>
        <tags>
          <value>data</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ee502838f53f00c9444b311f4cdea74454a1e0c64e8cdec3d63eb5232fb61f82</id>
    <title>Analysis Report for ee502838f53f00c9444b311f4cdea74454a1e0c64e8cdec3d63eb5232fb61f82</title>
    <updated>2026-10-05T13:03:27Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a07cd130e7ad45267a17</_id>
        <file_type>application/octet-stream</file_type>
        <flow_id>6ac3a01cb242df12a78e2d27</flow_id>
        <hash>ee502838f53f00c9444b311f4cdea74454a1e0c64e8cdec3d63eb5232fb61f82</hash>
        <iocs/>
        <name>$UpCase:$Info</name>
        <report_id>61cc7aa2-48fc-4878-be02-8799332a77f1</report_id>
        <tags>
          <value>data</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a9aa4a678a73523e05deadce98f900dd58d7c1f9380a6e7a91d1e25f4bee483a</id>
    <title>Analysis Report for a9aa4a678a73523e05deadce98f900dd58d7c1f9380a6e7a91d1e25f4bee483a</title>
    <updated>2026-10-05T13:03:27Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a06fd130e7ad45267a11</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac3a01cb242df12a78e2d27</flow_id>
        <hash>a9aa4a678a73523e05deadce98f900dd58d7c1f9380a6e7a91d1e25f4bee483a</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>0d340e7c9d3e1ed63e13336109d0856a327fee2b7e1e67d83108b0a10723def5</SHA-256>
              <SHA-1>469cbcbef06058b096ca20251de8c8da483d0734</SHA-1>
              <MD5>f918ec287ddfc45d18b3c02e557fa6c7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>ARPHADUMP.DLL</name>
        <report_id>b1a75ed7-cf39-4ae7-bc32-c310c3e6571b</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>similar-threat</value>
          <value>packed</value>
          <value>downloader</value>
          <value>dropper</value>
          <value>evasive</value>
          <value>overlay</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d73170b488c506d6f32130d7eb646090e393530a6fa8a34b95886efc3cea1fc4</id>
    <title>Analysis Report for d73170b488c506d6f32130d7eb646090e393530a6fa8a34b95886efc3cea1fc4</title>
    <updated>2026-10-05T13:03:27Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a091d130e7ad45267a23</_id>
        <file_type>application/octet-stream</file_type>
        <flow_id>6ac3a01cb242df12a78e2d27</flow_id>
        <hash>d73170b488c506d6f32130d7eb646090e393530a6fa8a34b95886efc3cea1fc4</hash>
        <iocs/>
        <name>WPSettings.dat</name>
        <report_id>ffe641e1-c3d7-4ced-9629-3101de0cab64</report_id>
        <tags>
          <value>data</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>b2ee510d0b5012487dee143b459e4e2fcfb758960d3fe7ec4743552bc91be9e2</id>
    <title>Analysis Report for b2ee510d0b5012487dee143b459e4e2fcfb758960d3fe7ec4743552bc91be9e2</title>
    <updated>2026-10-05T13:03:27Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a085d130e7ad45267a1f</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac3a01cb242df12a78e2d27</flow_id>
        <hash>b2ee510d0b5012487dee143b459e4e2fcfb758960d3fe7ec4743552bc91be9e2</hash>
        <iocs>
          <urls>
            <value>
              <url>http://crl.globalsign.com/ca/gstsacasha384g4.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://crl.globalsign.com/codesigningrootr45.crl0U</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://crl.globalsign.com/root-r3.crl0G</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl.globalsign.com/root-r6.crl0G</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl.globalsign.com/root.crl0G</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ocsp.globalsign.com/ca/gstsacasha384g40C</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ocsp.globalsign.com/codesigningrootr450F</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ocsp.globalsign.com/gsgccr45evcodesignca20200U</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ocsp.globalsign.com/rootr103</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ocsp.globalsign.com/rootr30;</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ocsp2.globalsign.com/rootr306</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ocsp2.globalsign.com/rootr606</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://secure.globalsign.com/cacert/codesigningrootr45.crt0A</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://secure.globalsign.com/cacert/gstsacasha384g4.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://secure.globalsign.com/cacert/root-r3.crt06</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.globalsign.com/repository/0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>crl.globalsign.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>globalsign.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>ocsp.globalsign.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>ocsp2.globalsign.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>secure.globalsign.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.18.21.226</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.20.226</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>146.75.118.133</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>146.75.122.133</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>23ebb7b2a8781998890b03128e7edc7580d8cc7c47c9aeffcfae4c4aa12d4891</SHA-256>
              <SHA-1>b9818c9e5df19321d69aaf80e53f765270288ff8</SHA-1>
              <MD5>debf2c424fd3fca258e6c52bf4e6b7d3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>7258150d0a904d22501f8b074a4e2469c1e9b3c0752e70ac22d67d773ec50447</SHA-256>
              <SHA-1>4565ff3e33df86a5422c212ee73800234439cb87</SHA-1>
              <MD5>ef831d0ce9d40403a2f485177d885d30</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>video/x-msvideo</file_type>
            </value>
            <value>
              <SHA-256>96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7</SHA-256>
              <SHA-1>1489f923c4dca729178b3e3233458550d8dddf29</SHA-1>
              <MD5>c4103f122d27677c9db144cae1394a66</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>972bbfd68eb65b5a130336ea7e77d90f1f034782726472640a4bfbfc0635ed28</SHA-256>
              <SHA-1>5977cf668abdd72b1299357894226be74e4a27fc</SHA-1>
              <MD5>ddb981bc6bf3557b43f12a3b460f3739</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>adeb9dacea20126ebaebcae4a7e0ecd8449ebb3c5fb9849948dffdb5062730b9</SHA-256>
              <SHA-1>f19d86fda0c1be0de6b9e3eddceea0e252655a47</SHA-1>
              <MD5>603dbacd24284e69e254ad98a0394edd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c1e12d9805d2234ee189ed741147029984add251ff24d54d59f732559ef2f859</SHA-256>
              <SHA-1>8b9ea8f85a52a80b0e0df8f3af60236e6f08d3ef</SHA-1>
              <MD5>63d2813dbda54c3cf6bbe4a919b4cb25</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c3e349877afcd32571289219b765743cb9d26a49112b6a5794fc83a93cc983e4</SHA-256>
              <SHA-1>9075913be000ddafb623e7786e15b964b0990a30</SHA-1>
              <MD5>b49bc4f59ebd6ab25c66a2a351355fd9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>ff04c16f07007618c7723eb538f879f89e297950bfa77ed55d1a19776f312a37</SHA-256>
              <SHA-1>cf9a68a0b175f131381d3d29245441a6f9d53e3d</SHA-1>
              <MD5>59517c0a5976f364558b42dbb1cabbc8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>ffe66d3b53059e6c308925ac38d89a7d3bb066f4f5aba9a7e7d2c03aa33f3faf</SHA-256>
              <SHA-1>2411e02f865736a7ddc4dfc6516c0df82419b616</SHA-1>
              <MD5>bfdee22fee9ea64429c0feaff694c3d4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128</SHA-256>
              <SHA-1>8c015d80b8a23f780bdd215dc842b0f5551f63bd</SHA-1>
              <MD5>5bfa51f3a417b98e7443eca90fc94703</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/octet-stream</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>1321162104.EXE</name>
        <report_id>b71e4d0d-1427-4144-865a-2a7639190391</report_id>
        <tags>
          <value>peexe</value>
          <value>data</value>
          <value>expired-cert</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>evasive</value>
          <value>explorer</value>
          <value>lolbin</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>dde045e173fc6e4e2c109d8678a4b5440f7d0807baa18e1cfb907f004bae8eb3</id>
    <title>Analysis Report for dde045e173fc6e4e2c109d8678a4b5440f7d0807baa18e1cfb907f004bae8eb3</title>
    <updated>2026-10-05T13:03:16Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a05dd130e7ad45267a0d</_id>
        <file_type>application/pdf</file_type>
        <flow_id>6ac3a012b242df12a78e2cf6</flow_id>
        <hash>dde045e173fc6e4e2c109d8678a4b5440f7d0807baa18e1cfb907f004bae8eb3</hash>
        <iocs>
          <emails>
            <value>
              <email>quotes@unileversupplies.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
          </emails>
          <files>
            <value>
              <SHA-256>3426d4f34b2869ec93366262279f256a260d87e5f76a3e065a35fb85d2033650</SHA-256>
              <SHA-1>98ae2177f11d16cb2b8b0015f8b0cedb307ea4f1</SHA-1>
              <MD5>c160de92ce9ba3af7503abc1177cf861</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>92cb7b1632cb8432de26d88f0c54657d3ac58332df7a8c9b5df1cd4afb3b7399</SHA-256>
              <SHA-1>370f29feffc33793aadd7109f70f099f8075441c</SHA-1>
              <MD5>48cb16f1289fdca1a530393d63795e8e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>e98f32361df6dbf77f79493d5a2e7ea85fe15007bb5e3adf3f3c3675b860af58</SHA-256>
              <SHA-1>f12c0f084948736445461542294a2ecfc89a39a4</SHA-1>
              <MD5>a41be97b34c06210dbecaf2f9e0145dc</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>f8b0400f0dd71a47e5187a8dea82ea655379a3ba6466e8c9fd8f17b35db5a611</SHA-256>
              <SHA-1>844f04c45b6f4933b401acd0c9daaa24976a373e</SHA-1>
              <MD5>7336cf5316e4f5ec6b4db26c50a31ed3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
          </files>
        </iocs>
        <name>RFQ-1_sanitized.pdf</name>
        <report_id>053a8fcc-1668-4ecd-9d12-7e5cfe663d8f</report_id>
        <tags>
          <value>pdf</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>aec6d50d01b9e711dfd5505ab9148c4a28c6c8237b290265f5d94c9c4ae8c9d0</id>
    <title>Analysis Report for aec6d50d01b9e711dfd5505ab9148c4a28c6c8237b290265f5d94c9c4ae8c9d0</title>
    <updated>2026-10-05T13:02:58Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a074d130e7ad45267a13</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39fffedc8b0d17b0043ba</flow_id>
        <hash>aec6d50d01b9e711dfd5505ab9148c4a28c6c8237b290265f5d94c9c4ae8c9d0</hash>
        <iocs>
          <urls>
            <value>
              <url>https://admi-dom.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://admi-dom.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/#content</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/actualites/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/aide-aux-entreprises/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/cgv/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/contacts/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/credits-et-mentions-legales/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/domiciliation-courrier-a-perpignan/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/domiciliation-dentreprise-a-perpignan/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/domiciliation/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/gestion-reseaux-sociaux-entreprises-66/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/nos-services-admidom/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/permanence-telephonique/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/politique-de-confidentialite/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/qui-sommes-nous/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/cache/wpfc-minified/8ly7njyw/fgl5e.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/cache/wpfc-minified/f4ozxvsm/fgl5c.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js?ver=1770907599</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.33.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.33.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor-pro/assets/js/load-more.8b46f464e573feab5dd7.bundle.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor-pro/assets/js/nav-menu.8521a0597c50611efdc6.bundle.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor-pro/assets/js/posts.aec59265318492b89cb5.bundle.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.33.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.min.js?ver=1.2.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor/assets/js/chunks/background-slideshow.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor/assets/js/chunks/background-video.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor/assets/js/chunks/text-editor.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/themes/hello-elementor/assets/js/hello-frontend.js?ver=3.4.5</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/uploads/2025/12/Copie-de-hc-Visuel-mars-2026-2.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/uploads/2025/12/cropped-3-32x32.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/uploads/2025/12/cropped-Design-sans-titre-54.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/uploads/2025/12/diapo-cantoche-2-1024x576.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/uploads/2025/12/imgi_2_2025-04-07-HCSHP-00108-scaled-1.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/uploads/2026/02/IMG_4409-scaled.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/uploads/2026/03/Design-sans-titre-19-scaled.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/uploads/2026/07/centre-daffaires-logo.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/uploads/complianz/css/banner-1-optin.css?v=16</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-includes/js/dist/hooks.min.js?ver=f0f188028580e8dc1255</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-includes/js/dist/i18n.min.js?ver=1dfe7db3940c23ea9216</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-includes/js/imagesloaded.min.js?ver=5.0.0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-includes/js/jquery/ui/core.min.js?ver=1.14.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-includes/js/wp-emoji-release.min.js?ver=7.1.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Archivo:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Montserrat:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Open+Sans:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Poppins:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Prompt:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Roboto+Slab:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Roboto:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/archivo/v25/k3kPo8UDI-1M0wlSV9XAw6lQkqWY8Q82sLydOxI.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/poppins/v24/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fr.linkedin.com/company/admi-dom</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://g.page/r/CeqKSBveq6BcEBM/review</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect?v=2&amp;tid=G-NTNEKJK9V1&amp;gtm=45Pe69u2v9243499756za200zd9243499756xf1&amp;_p=1791205459035&amp;gcd=13l3l3l2l1l1&amp;npa=1&amp;dma_cps=a&amp;dma=1&amp;gdid=dZTNiMT&amp;are=1&amp;cid=1150271829.1791205459&amp;frm=0&amp;ngs=1&amp;pscdl=noapi&amp;rcb=2&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;_s=1&amp;tag_exp=115616986~115938466~115938469~118897920~118897930~120213116~120385422~120469145~120469153&amp;sid=1791205459&amp;sct=1&amp;seg=0&amp;dl=https%3A%2F%2Fadmi-dom.com%2F&amp;dt=Domiciliation%20d%E2%80%99entreprise%20%C3%A0%20Perpignan%20(66)%20%7C%20AdmiDom%2066&amp;en=page_view&amp;_fv=1&amp;_nsi=1&amp;_ss=1&amp;_ee=1&amp;tfd=392</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.centredaffairesdusoler.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/AdmiDom66/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.com/maps/place/Centre+d'Affaires+-+Le+Soler+%2F%2F+DOMICILIATION+-+BUREAU+DE+COWORKING+-+PEPINIERE+D'ENTREPRISES+-+FORMATION/@42.6873427,2.82581,17z/data=!3m1!4b1!4m6!3m5!1s0x12b06d9b6d641749:0xeb652cf1746dd51a!8m2!3d42.6873427!4d2.82581!16s%2Fg%2F11y8_0ybw7?entry=ttu&amp;g_ep=EgoyMDI2MDMxNS4wIKXMDSoASAFQAw%3D%3D</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=GT-K8DRCMZB</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/&amp;dt=Domiciliation</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/&amp;format=xml</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/actualites/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/aide-aux-entreprises/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/cgv/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/comments/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/contacts/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/credits-et-mentions-legales/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/domiciliation-courrier-a-perpignan/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/domiciliation-dentreprise-a-perpignan/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/domiciliation/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/gestion-reseaux-sociaux-entreprises-66/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/nos-services-admidom/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/permanence-telephonique/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/politique-de-confidentialite/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/qui-sommes-nous/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js?ver=1770907599</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.33.2</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.33.2</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.33.2</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.min.js?ver=1.2.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/themes/hello-elementor/assets/js/hello-frontend.js?ver=3.4.5</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/uploads/2025/12/cropped-3-180x180.jpg</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/uploads/2025/12/cropped-3-192x192.jpg</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-content/uploads/2025/12/cropped-3-32x32.jpg</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-includes/js/dist/hooks.min.js?ver=f0f188028580e8dc1255</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-includes/js/dist/i18n.min.js?ver=1dfe7db3940c23ea9216</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-includes/js/imagesloaded.min.js?ver=5.0.0</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-includes/js/jquery/ui/core.min.js?ver=1.14.2</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-includes/js/wp-emoji-loader.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-includes/js/wp-emoji-release.min.js?ver=7.1.2</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-json/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-json/complianz/v1/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/wp-json/oembed/1.0/embed</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fadmi-dom.com%2F</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fadmi-dom.com%2F&amp;format=xml</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/wp-json/wp/v2/pages/7</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/xmlrpc.php?rsd</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Archivo:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Montserrat:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Open+Sans:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Poppins:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Prompt:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Roboto+Slab:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Roboto:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fr.linkedin.com/company/admi-dom</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://g.page/r/CeqKSBveq6BcEBM/review</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://gmpg.org/xfn/11</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.w.org/images/core/emoji/17.0.2/72x72/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://s.w.org/images/core/emoji/17.0.2/svg/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.centredaffairesdusoler.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/AdmiDom66/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.google.com/maps/place/Centre+d'Affaires+-+Le+Soler+%2F%2F+DOMICILIATION+-+BUREAU+DE+COWORKING+-+PEPINIERE+D'ENTREPRISES+-+FORMATION/@42.6873427,2.82581,17z/data=!3m1!4b1!4m6!3m5!1s0x12b06d9b6d641749:0xeb652cf1746dd51a!8m2!3d42.6873427!4d2.82581!16s%2Fg%2F11y8_0ybw7?entry=ttu&amp;g_ep=EgoyMDI2MDMxNS4wIKXMDSoASAFQAw%3D%3D</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=GT-K8DRCMZB</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>admi-dom.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>fr.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>g.page</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>gmpg.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>s.w.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.centredaffairesdusoler.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>admi-dom.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fr.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>g.page</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>region1.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.centredaffairesdusoler.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.127.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>216.239.34.36</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>54.36.91.62</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.157.119</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.64.146.215</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>54.36.91.62</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>66.155.40.24</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>216.239.32.27</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>57.144.244.1</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.0.77.48</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>0d037d0ac35111285f00289e1a929e539c278d4d47847b8e8059793d4ba0908a</SHA-256>
              <SHA-1>927331f261aa900ba4de828e75d2f6c3b786bcb2</SHA-1>
              <MD5>f90520ce8a94803be7864ed7ee493c24</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>da3c0ba604cfafabe8507b9b4323622e70b7f30bb445990f287d21b331c6895f</SHA-256>
              <SHA-1>40c6138b9163691d00ad75ec5fbe0cf624aca0e3</SHA-1>
              <MD5>c7ade40ed92bdfb1901ec3aeb2bdd006</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>8014bc59083388c6b86bb1b191885a039e37148440ae56ef0cca616f18450d73</SHA-256>
              <SHA-1>1725c15c0369307a4dbd9577c674ca26c2ad7028</SHA-1>
              <MD5>dc81809ce76d984acf6429fed841b3e8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>d82a80457b5d5b7ff04cbd539e2557770a2533e3510c133c55e115dfd2728f93</SHA-256>
              <SHA-1>916c2ddc388503f0abce1d7dbdaee2b0ac42cc41</SHA-1>
              <MD5>5424eacf5be5dce4d2345ddc51b5eeb4</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>723ad2e5d13829308d65cf4c2963078b51e3b90aaeaf0fbe69af9d8f7b73f00e</SHA-256>
              <SHA-1>7f115871e1c3e1adaa64ca02db291ed0586d34ff</SHA-1>
              <MD5>130b638010bca0fb5cac22f54c5a5478</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>1f070fbce88ced0bdbf64462d5012140d6a9f9bbe205bf7319162e39c8bbf704</SHA-256>
              <SHA-1>9a0b52afceafb6ca986b04ff5e8154c5bf69010f</SHA-1>
              <MD5>4c5414180ad7ae0fcff22bc23d22f505</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/rss+xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3</SHA-256>
              <SHA-1>c90b1ed149a278c322a63f3a79443ccce5592382</SHA-1>
              <MD5>7dcb0bb1f67bc5cd9aa86bc0577108e3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>2312e2af7de8ecba77b54d69322e66882c55e28d0bf538a2059cf804280bef8c</SHA-256>
              <SHA-1>b85f44f3f2f336d1da83a40a59ad41b9d2d2f349</SHA-1>
              <MD5>ba5ff0c7195276587a922609e15d0b19</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://admi-dom.com/</name>
        <report_id>4a05f153-9d4d-4622-ae4b-24371a33a8dd</report_id>
        <tags>
          <value>html</value>
          <value>txt</value>
          <value>javascript</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>2eeb40d144dc847f1010e41cd57346a132d598990c50522f7bf9c7fc8a459f1c</id>
    <title>Analysis Report for 2eeb40d144dc847f1010e41cd57346a132d598990c50522f7bf9c7fc8a459f1c</title>
    <updated>2026-10-05T13:02:56Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a03f89017dd18dc1c365</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39fffb242df12a78e2cad</flow_id>
        <hash>2eeb40d144dc847f1010e41cd57346a132d598990c50522f7bf9c7fc8a459f1c</hash>
        <iocs>
          <urls>
            <value>
              <url>https://community.ovh.com/en/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docs.ovh.com/gb/en/hosting/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://gats-group.com/__ovh/common/font/lato-light-webfont.woff</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://gats-group.com/__ovh/common/img/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://gats-group.com/__ovh/common/img/icon-app-gear.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://gats-group.com/__ovh/common/img/icon-book.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://gats-group.com/__ovh/common/img/icon-speech-bubble.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://gats-group.com/__ovh/common/img/icon-traffic-cone.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://gats-group.com/__ovh/common/img/icon-user-support.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://gats-group.com/__ovh/common/img/logo-white.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://gats-group.com/__ovh/common/img/shadow.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://gats-group.com/__ovh/common/img/transparentTriangle.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://gats-group.com/__ovh/en/welcome.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://help.ovhcloud.com/en-gb/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.ovh.com/manager/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.ovhcloud.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.ovh.com/en/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.ovh.com/gb/en/hosting/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://help.ovhcloud.com/en-gb/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.ovh.com/manager/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.ovhcloud.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://gats-group.com/__ovh/en/welcome.html</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>community.ovh.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>docs.ovh.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>gats-group.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>help.ovhcloud.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.ovh.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.ovhcloud.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>community.ovh.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>docs.ovh.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>help.ovhcloud.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.ovh.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.ovhcloud.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>188.165.6.81</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>213.32.5.112</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>198.27.92.14</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>198.27.92.1</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>5.135.23.164</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>3c07608598bf3e50b264a61e52b68da186059fcbe1d09a87e3fa64c141793ea0</SHA-256>
              <SHA-1>5027b348ed357a8bbe0332d4e6f00710326b37d2</SHA-1>
              <MD5>5d8007ca14e354fa1b479c73966526d5</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>e130e54573dce709eebffe2f36dfb9266df2b248cbd6cdf9afbe7e2510fc5807</SHA-256>
              <SHA-1>52c32ec08f3374cfd6cf44caa18cb334d51a7e6b</SHA-1>
              <MD5>751c633b3716bee750b31c9596cec838</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>44ebe2668d9691065d278611528000c54363ad097f9244b5affcf5c8f6c0dbb5</SHA-256>
              <SHA-1>2670de238e5d7a39ce7aef65bf4ff21be9400b2e</SHA-1>
              <MD5>776dd59e3c74e9830b486e8c9b39722c</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>1748ad82ed0593548fca0dcf2b9076e74e012af7638d5bbd18d20cb874cb5548</SHA-256>
              <SHA-1>194b91bdd54c46d4e7321bf60d55396bee1f0e1e</SHA-1>
              <MD5>3550137bb7fe939e99757b556868b972</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://gats-group.com/__ovh/en/welcome.html</name>
        <report_id>8faad577-ff01-4b1e-86ea-565706fba141</report_id>
        <tags>
          <value>html</value>
          <value>anti-vm</value>
          <value>obfuscated</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>51c30cf578a02e3b391d3731c86c343b28f7083633fa7e2d53ed0d027c6e649f</id>
    <title>Analysis Report for 51c30cf578a02e3b391d3731c86c343b28f7083633fa7e2d53ed0d027c6e649f</title>
    <updated>2026-10-05T13:02:56Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a07f89017dd18dc1c374</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39fff82af77f74b7f6300</flow_id>
        <hash>51c30cf578a02e3b391d3731c86c343b28f7083633fa7e2d53ed0d027c6e649f</hash>
        <iocs>
          <urls>
            <value>
              <url>https://admi-dom.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://centredaffairesdusoler.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Anton:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Montserrat:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Open+Sans:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Prompt:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Roboto:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/anton/v27/1Ptgg87LROyAm3Kz-C8.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/montserrat/v31/JTUQjIg1_i6t8kCHKm459WxRyS7m.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/prompt/v12/-W_8XJnvUD7dzB2Cy_gIaWMu.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/#content</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/actualites/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/conditions-generales-de-vente/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/contacts/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/mentions-legales/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/nos-espaces/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/nos-services/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/politique-de-confidentialite/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/complianz-gdpr/assets/css/cookieblocker.min.css?ver=1770735780</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js?ver=1770735781</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor-pro/assets/css/conditionals/transitions.min.css?ver=3.33.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor-pro/assets/css/widget-call-to-action.min.css?ver=3.33.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor-pro/assets/css/widget-nav-menu.min.css?ver=3.33.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.33.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.33.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor-pro/assets/js/nav-menu.8521a0597c50611efdc6.bundle.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.33.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.min.js?ver=1.2.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/css/conditionals/apple-webkit.min.css?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/css/conditionals/shapes.min.css?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/css/widget-heading.min.css?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/css/widget-image-box.min.css?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/css/widget-image.min.css?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/css/widget-social-icons.min.css?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/css/widget-spacer.min.css?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/js/chunks/background-slideshow.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/js/chunks/background-video.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/js/chunks/text-editor.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/lib/animations/styles/fadeIn.min.css?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/lib/animations/styles/fadeInDown.min.css?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/lib/animations/styles/fadeInLeft.min.css?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/lib/animations/styles/fadeInRight.min.css?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/lib/animations/styles/fadeInUp.min.css?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/themes/hello-elementor/assets/css/header-footer.css?ver=3.4.5</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/themes/hello-elementor/assets/css/reset.css?ver=3.4.5</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/themes/hello-elementor/assets/css/theme.css?ver=3.4.5</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/themes/hello-elementor/assets/js/hello-frontend.js?ver=3.4.5</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/uploads/2025/11/Design-sans-titre-66-150x150.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/uploads/2025/12/2025-04-07-HCSHP-00102-HDR-1-scaled-1-2048x1366.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/uploads/2025/12/cropped-Logo-horizontal-vert-prairie-01-scaled-1-2048x585.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/uploads/2025/12/imgi_5_2025-04-07-HCSHP-00011-HDR-scaled-1-768x512.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/uploads/2026/07/2026-02-25.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/uploads/2026/07/Cyril-MARCER-Moyenne.jpeg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/uploads/2026/07/centre-daffaires-logo.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/uploads/complianz/css/banner-1-optin.css?v=30</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/uploads/elementor/css/post-113.css?ver=1790849016</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/uploads/elementor/css/post-144.css?ver=1790849469</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/uploads/elementor/css/post-5.css?ver=1790849016</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/uploads/elementor/css/post-7.css?ver=1790849469</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-includes/js/dist/hooks.min.js?ver=f0f188028580e8dc1255</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-includes/js/dist/i18n.min.js?ver=1dfe7db3940c23ea9216</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-includes/js/jquery/ui/core.min.js?ver=1.14.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-includes/js/wp-emoji-release.min.js?ver=7.1.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://la-cantoche.marketplace.dood.com/fr</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://portail.humancowork.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect?v=2&amp;tid=G-RQJQVV3V0Y&amp;gtm=45Pe69u2v9243375633za200zd9243375633xf1&amp;_p=1791205459865&amp;gcd=13l3l3l2l1l1&amp;npa=1&amp;dma_cps=a&amp;dma=1&amp;gdid=dZTNiMT&amp;are=1&amp;cid=1072189850.1791205460&amp;frm=0&amp;ngs=1&amp;pscdl=noapi&amp;rcb=0&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;_s=1&amp;tag_exp=115938465~115938468~118897920~118897930~120213116~120385423~120469145~120469153&amp;sid=1791205460&amp;sct=1&amp;seg=0&amp;dl=https%3A%2F%2Fhumancowork.com%2F&amp;dt=Location%20de%20Bureau%20au%20Soler%20%E2%80%93%20Bureau%20%C3%A0%20Louer%20pr%C3%A8s%20de%20Perpignan&amp;en=page_view&amp;_fv=1&amp;_nsi=1&amp;_ss=1&amp;_ee=1&amp;tfd=1318</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.centredaffairesdusoler.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.centredaffairesdusoler.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/humancowork/?locale=fr_FR</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.com/maps?client=safari&amp;rls=en&amp;oe=UTF-8&amp;um=1&amp;ie=UTF-8&amp;fb=1&amp;gl=fr&amp;sa=X&amp;geocode=KUkXZG2bbbASMRrVbXTxLGXr&amp;daddr=11+avenue+de+madrid,+66270+Le+Soler</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=GT-K463PWWF</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/humancowork/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://humancowork.com/&amp;dt=Location</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://humancowork.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/&amp;format=xml</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://centredaffairesdusoler.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Anton:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Montserrat:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Open+Sans:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Prompt:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Roboto:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://gmpg.org/xfn/11</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/comments/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/complianz-gdpr/assets/css/cookieblocker.min.css?ver=1770735780</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js?ver=1770735781</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor-pro/assets/css/conditionals/transitions.min.css?ver=3.33.2</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor-pro/assets/css/widget-call-to-action.min.css?ver=3.33.2</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor-pro/assets/css/widget-nav-menu.min.css?ver=3.33.2</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.33.2</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.33.2</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.33.2</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.min.js?ver=1.2.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/css/conditionals/apple-webkit.min.css?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/css/conditionals/shapes.min.css?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/css/widget-heading.min.css?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/css/widget-image-box.min.css?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/css/widget-image.min.css?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/css/widget-social-icons.min.css?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/css/widget-spacer.min.css?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/lib/animations/styles/fadeIn.min.css?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/lib/animations/styles/fadeInDown.min.css?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/lib/animations/styles/fadeInLeft.min.css?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/lib/animations/styles/fadeInRight.min.css?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/plugins/elementor/assets/lib/animations/styles/fadeInUp.min.css?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/themes/hello-elementor/assets/css/header-footer.css?ver=3.4.5</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/themes/hello-elementor/assets/css/reset.css?ver=3.4.5</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/themes/hello-elementor/assets/css/theme.css?ver=3.4.5</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/themes/hello-elementor/assets/js/hello-frontend.js?ver=3.4.5</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/uploads/elementor/css/post-113.css?ver=1790849016</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/uploads/elementor/css/post-144.css?ver=1790849469</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/uploads/elementor/css/post-5.css?ver=1790849016</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-content/uploads/elementor/css/post-7.css?ver=1790849469</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-includes/js/dist/hooks.min.js?ver=f0f188028580e8dc1255</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-includes/js/dist/i18n.min.js?ver=1dfe7db3940c23ea9216</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-includes/js/jquery/ui/core.min.js?ver=1.14.2</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-json/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-json/oembed/1.0/embed</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fhumancowork.com%2F</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fhumancowork.com%2F&amp;format=xml</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://la-cantoche.marketplace.dood.com/fr</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://portail.humancowork.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.w.org/images/core/emoji/17.0.2/72x72/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://s.w.org/images/core/emoji/17.0.2/svg/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.centredaffairesdusoler.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.centredaffairesdusoler.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/humancowork/?locale=fr_FR</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.google.com/maps?client=safari&amp;rls=en&amp;oe=UTF-8&amp;um=1&amp;ie=UTF-8&amp;fb=1&amp;gl=fr&amp;sa=X&amp;geocode=KUkXZG2bbbASMRrVbXTxLGXr&amp;daddr=11+avenue+de+madrid,+66270+Le+Soler</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=GT-K463PWWF</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/humancowork/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://humancowork.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>admi-dom.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>centredaffairesdusoler.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>humancowork.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>la-cantoche.marketplace.dood.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>portail.humancowork.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>region1.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.centredaffairesdusoler.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.instagram.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>admi-dom.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>centredaffairesdusoler.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>gmpg.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>humancowork.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>la-cantoche.marketplace.dood.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>portail.humancowork.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.w.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.centredaffairesdusoler.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.instagram.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>192.0.77.48</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>66.155.40.24</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>51.91.236.193</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>57.144.244.34</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>13.226.244.24</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>54.36.91.62</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>54.38.113.135</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.157.119</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>57.144.244.1</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>216.239.32.36</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>51.91.236.193</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>aec6d50d01b9e711dfd5505ab9148c4a28c6c8237b290265f5d94c9c4ae8c9d0</SHA-256>
              <SHA-1>7aafff67980d719e526dd819cb67f7085d4fac6f</SHA-1>
              <MD5>426bdb817e6ea7c65590655e733b4e93</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>cb71b2feea06fed776fdc0d46e4c3602455d0dbcdc83eaa59b06170e33dce84c</SHA-256>
              <SHA-1>b59eb79ebef37ee9f15c1d58d001048b42281414</SHA-1>
              <MD5>58634ae348c6ccd4cc4feb9e43cbe8ea</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>a96bf72d19f5806113f6ba18ecc0a9455c0c447bcee86e677b1d2279b1dea054</SHA-256>
              <SHA-1>24043fd4632312fba4d3ac690ebca475ca2fa327</SHA-1>
              <MD5>562a84f54d437111e0334e23345826d0</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/css</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>0d037d0ac35111285f00289e1a929e539c278d4d47847b8e8059793d4ba0908a</SHA-256>
              <SHA-1>927331f261aa900ba4de828e75d2f6c3b786bcb2</SHA-1>
              <MD5>f90520ce8a94803be7864ed7ee493c24</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>478f275414c4950bc309482c35bfdc8459675f200d2b883c68b9f02305d854b6</SHA-256>
              <SHA-1>877e81eb93338f4fddec62aa84f6dd5e855afae7</SHA-1>
              <MD5>7deb97fc01caca3145c3ac9ba3504abb</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/css</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>9c4b4081d4027c34cafeeb33a6bb6bf8c2a493a25e0a476d446e89d3a2dedebf</SHA-256>
              <SHA-1>23a94e7a6db925a730daa03bc1867fa79ed255a1</SHA-1>
              <MD5>5609f241b42d7d32ebce82359b104603</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/css</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>bbeaaf1185f5795fdbe1222a69e36efbb9685578ccfed0201cfaa607857e9efd</SHA-256>
              <SHA-1>fe847b11a7624397c50fa3e0f093b197223115cb</SHA-1>
              <MD5>43c6a1331c0f563b3915eb56847a5e41</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/css</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>3d675aa2a0daa5e5b0080f14f3335f2d7a15275badcc418deba1e740a5ea55ab</SHA-256>
              <SHA-1>3ddff674c5f9cd149de491cf5df81c1074eaf397</SHA-1>
              <MD5>9e6b9ba92c3c07c25c3a64a82c98afc3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/css</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://humancowork.com/</name>
        <report_id>c0d4443c-b2af-48f5-82e4-df90337eb475</report_id>
        <tags>
          <value>html</value>
          <value>txt</value>
          <value>aidetect</value>
          <value>phishing</value>
          <value>obfuscated</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>036eaac0efaba862a8f416598e481a4cfaec6b84e4684bdd4e68846e28512069</id>
    <title>Analysis Report for 036eaac0efaba862a8f416598e481a4cfaec6b84e4684bdd4e68846e28512069</title>
    <updated>2026-10-05T13:02:55Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a03b89017dd18dc1c364</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39fffedc8b0d17b0043bb</flow_id>
        <hash>036eaac0efaba862a8f416598e481a4cfaec6b84e4684bdd4e68846e28512069</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.lacantochedusoler.fr/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/&amp;format=xml</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://la-cantoche.marketplace.dood.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admi-dom.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.trustindex.io/loader.js?ver=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cookiedatabase.org/tcf/purposes/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Poppins:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Roboto+Slab:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Roboto:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://maps.app.goo.gl/JuBXu4jZLYAv5sNV9</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://maps.google.com/maps?q=11%20rue%20de%20Madrid%2C%20centre%20d%27affaires%2C%2066270%20Le%20Soler&amp;t=m&amp;z=12&amp;output=embed&amp;iwloc=near</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.w.org/images/core/emoji/17.0.2/72x72/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://s.w.org/images/core/emoji/17.0.2/svg/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://snapchat.com/t/RkVHX9LA</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.calameo.com/read/0081799523434ab9b6e11</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.centredaffairesdusoler.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/lacantochedusoler</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.google.com/recaptcha/api.js?render=explicit&amp;ver=4.2.3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=GT-P8RZ6N4M</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/lacantochedusoler/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/comments/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/gestion-des-cookies/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/mentions-legales/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/politique-de-confidentialite/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wp-json/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wp-json/complianz/v1/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wp-json/oembed/1.0/embed</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.lacantochedusoler.fr%2F</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.lacantochedusoler.fr%2F&amp;format=xml</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wp-json/wp/v2/pages/1914</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js?ver=1789007683</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=4.2.3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=4.2.3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=4.2.3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.min.js?ver=1.2.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=4.3.3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor/assets/lib/swiper/v8/swiper.min.js?ver=8.4.5</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/themes/hello-elementor/assets/js/hello-frontend.js?ver=3.4.7</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/uploads/2026/05/cropped-3-2-180x180.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/uploads/2026/05/cropped-3-2-192x192.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/uploads/2026/05/cropped-3-2-32x32.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-includes/js/dist/hooks.min.js?ver=f0f188028580e8dc1255</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-includes/js/dist/i18n.min.js?ver=1dfe7db3940c23ea9216</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-includes/js/imagesloaded.min.js?ver=5.0.0</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-includes/js/jquery/jquery.min.js?ver=3.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-includes/js/jquery/ui/core.min.js?ver=1.14.2</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-includes/js/wp-emoji-loader.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-includes/js/wp-emoji-release.min.js?ver=7.1.2</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/xmlrpc.php?rsd</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.tiktok.com/@lacantoche_lesoler</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.trustindex.io/?a=sys&amp;c=wp-top-rated-badge&amp;url=/the-trustindex-verified-badge/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://la-cantoche.marketplace.dood.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://admi-dom.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.trustindex.io/loader.js?ver=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cookiedatabase.org/tcf/purposes/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Poppins:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Roboto+Slab:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Roboto:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/poppins/v24/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/poppins/v24/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://maps.app.goo.gl/JuBXu4jZLYAv5sNV9</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect?v=2&amp;tid=G-4QVGQRXK28&amp;gtm=45Pe69u2v9233700411za200zd9233700411xf1&amp;_p=1791205398509&amp;gcd=13l3l3l2l1l1&amp;npa=1&amp;dma_cps=a&amp;dma=1&amp;gdid=dZTNiMT&amp;are=1&amp;cid=916933692.1791205399&amp;frm=0&amp;ngs=1&amp;pscdl=noapi&amp;rcb=16&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;_s=1&amp;tag_exp=115938465~115938469~118897920~118897930~120213116~120385423~120469145~120469153~121246027~121246035&amp;sid=1791205398&amp;sct=1&amp;seg=0&amp;dl=https%3A%2F%2Fwww.lacantochedusoler.fr%2F&amp;dt=Restaurant%20au%20Soler%20-%20La%20Cantoche&amp;en=page_view&amp;_fv=1&amp;_nsi=1&amp;_ss=1&amp;_ee=1&amp;tfd=772</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://snapchat.com/t/RkVHX9LA</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.calameo.com/read/0081799523434ab9b6e11</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.centredaffairesdusoler.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/lacantochedusoler</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.com/recaptcha/api.js?render=explicit&amp;ver=4.2.3</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/recaptcha/api2/anchor?ar=1&amp;k=6LeVK1UtAAAAAPN3L5LV5rNq2DeUOX8OQyPgbSkK&amp;co=aHR0cHM6Ly93d3cubGFjYW50b2NoZWR1c29sZXIuZnI6NDQz&amp;hl=en&amp;type=v3&amp;v=guXhH0v-XMzwgr6KUGswGxeS&amp;size=invisible&amp;badge=bottomright&amp;sa=Form&amp;anchor-ms=20000&amp;execute-ms=30000&amp;ovv=CAB5am5W&amp;cb=tkhm10jd8yfh</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=GT-P8RZ6N4M</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/recaptcha/releases/guXhH0v-XMzwgr6KUGswGxeS/recaptcha__en.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/lacantochedusoler/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/#Réserver</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/#cmplz-cookies-overview</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/#cmplz-manage-consent-container</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/#cmplz-tcf-wrapper</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/#contact</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/#lacarte</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/#nouveauté</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/#àpropos</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/gestion-des-cookies/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/mentions-legales/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/politique-de-confidentialite/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/cache/wpfc-minified/6xdrlxl5/ffkmz.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/cache/wpfc-minified/87bc9ynj/ffkmz.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/cache/wpfc-minified/9anmuz2b/ffkmz.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/cache/wpfc-minified/k2atls0k/ffkmz.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js?ver=1789007683</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=4.2.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor-pro/assets/js/form.cfd61a9174be80f835c6.bundle.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=4.2.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor-pro/assets/js/mega-menu-stretch-content.7ed04741ba7d5a80c556.bundle.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor-pro/assets/js/mega-menu.857df1cf3198ae47b617.bundle.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor-pro/assets/js/menu-title-keyboard-handler.b3891112675eb0b0c4d5.bundle.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor-pro/assets/js/nav-menu.dc8790fd04afa5b6c0a3.bundle.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor-pro/assets/js/popup.61d4fcab8891b2e07802.bundle.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor-pro/assets/js/slides.8e9b74f1b31471377df8.bundle.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=4.2.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.min.js?ver=1.2.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor/assets/js/chunks/background-slideshow.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor/assets/js/chunks/background-video.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor/assets/js/chunks/text-editor.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor/assets/js/chunks/toggle.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=4.3.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/plugins/elementor/assets/lib/swiper/v8/swiper.min.js?ver=8.4.5</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/themes/hello-elementor/assets/js/hello-frontend.js?ver=3.4.7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/uploads/2026/05/Design-sans-titre-88-Grande.jpeg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/uploads/2026/05/cropped-3-2-32x32.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/uploads/2026/05/decotravo-logo-2-1024x1024.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/uploads/2026/05/video-header-site2.mp4</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/uploads/2026/07/81692419-cf8b-4a9e-bae0-7b151bf92c7f-2.jpeg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/uploads/2026/07/imgi_184_32825E4B-CF25-4B5A-937A-639E0A6E1D03-scaled-e1779097572314-Grande-Grande-Moyenne.jpeg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-content/uploads/complianz/css/banner-1-optin.css?v=64</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-includes/js/dist/hooks.min.js?ver=f0f188028580e8dc1255</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-includes/js/dist/i18n.min.js?ver=1dfe7db3940c23ea9216</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-includes/js/imagesloaded.min.js?ver=5.0.0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-includes/js/jquery/jquery.min.js?ver=3.7.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-includes/js/jquery/ui/core.min.js?ver=1.14.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/wpcant/wp-includes/js/wp-emoji-release.min.js?ver=7.1.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.tiktok.com/@lacantoche_lesoler</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.trustindex.io/?a=sys&amp;c=wp-top-rated-badge&amp;url=/the-trustindex-verified-badge/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.lacantochedusoler.fr/&amp;dt=Restaurant</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>admi-dom.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>cdn.trustindex.io</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>cookiedatabase.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>la-cantoche.marketplace.dood.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>lacantochedusoler.fr</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>maps.app.goo.gl</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>maps.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>s.w.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>snapchat.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.calameo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.centredaffairesdusoler.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.instagram.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.lacantochedusoler.fr</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.tiktok.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.trustindex.io</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>admi-dom.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cdn.trustindex.io</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cookiedatabase.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>la-cantoche.marketplace.dood.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>maps.app.goo.gl</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>region1.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>snapchat.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.calameo.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.centredaffairesdusoler.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.instagram.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.lacantochedusoler.fr</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.tiktok.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.trustindex.io</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>188.114.97.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>85.233.202.179</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>57.144.244.34</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>3.167.227.7</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.194.190.168</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>54.36.91.62</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>13.226.244.33</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>46.105.57.169</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>57.144.244.1</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.0.77.48</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>34.149.46.130</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>13.33.187.28</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.250.154.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.250.154.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.154.119</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.155.119</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>216.239.34.36</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>46.105.57.169</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.250.154.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>13.33.187.25</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>0d037d0ac35111285f00289e1a929e539c278d4d47847b8e8059793d4ba0908a</SHA-256>
              <SHA-1>927331f261aa900ba4de828e75d2f6c3b786bcb2</SHA-1>
              <MD5>f90520ce8a94803be7864ed7ee493c24</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>33379c349a49b142407bc76a0ba10ea37416c2c33e4a13cb929a4c53d187771f</SHA-256>
              <SHA-1>25c5bde4ed67a3f4c2457f6fcc05bd85ef081af8</SHA-1>
              <MD5>fef6aa687bc3f6117dca54f5ece87b8f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>62cef04f30561574c1979e0dcdc33c6e2e2b06644a5e3567c52c526eff8aa954</SHA-256>
              <SHA-1>7ba83e4b91d7e7a95381e2bb2550fbd480cee4d8</SHA-1>
              <MD5>26c4278d8c7dce5bde7647a60e7ad233</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>aec6d50d01b9e711dfd5505ab9148c4a28c6c8237b290265f5d94c9c4ae8c9d0</SHA-256>
              <SHA-1>7aafff67980d719e526dd819cb67f7085d4fac6f</SHA-1>
              <MD5>426bdb817e6ea7c65590655e733b4e93</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>fa6d0be24742b4422e8694e2a6f76d25c01c0d687cdb72ad285afdb8db687afe</SHA-256>
              <SHA-1>574b6f9b5386e4c2af5e8af72a09d2cfa1ae54b2</SHA-1>
              <MD5>674afa7ca96a1cb7acee009b1d7904e3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3</SHA-256>
              <SHA-1>c90b1ed149a278c322a63f3a79443ccce5592382</SHA-1>
              <MD5>7dcb0bb1f67bc5cd9aa86bc0577108e3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>2312e2af7de8ecba77b54d69322e66882c55e28d0bf538a2059cf804280bef8c</SHA-256>
              <SHA-1>b85f44f3f2f336d1da83a40a59ad41b9d2d2f349</SHA-1>
              <MD5>ba5ff0c7195276587a922609e15d0b19</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>03ab2e34d7f6f7559f97ce40b9591e82f8d53ee7025b2c37f5238d646e7f8b59</SHA-256>
              <SHA-1>a45781633cbaa71fbe6379adf2e6ec08c118ecde</SHA-1>
              <MD5>e0aaa626ec668cd24d86290cfd7c9f75</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>32825E4B-CF25-4B5A-937A-639E0A6E1D03</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>81692419-cf8b-4a9e-bae0-7b151bf92c7f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://www.lacantochedusoler.fr/</name>
        <report_id>eab85eac-71f5-4a26-bbec-6f1c1bfbc705</report_id>
        <tags>
          <value>html</value>
          <value>javascript</value>
          <value>txt</value>
          <value>obfuscated</value>
          <value>kiosk</value>
          <value>captcha</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T13:02:52Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a00989017dd18dc1c356</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39ff982af77f74b7f62f5</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>5e79f662-849b-4127-be8e-a2b2054b54b4</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T13:02:46Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3a004d130e7ad452679fa</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39ff482af77f74b7f62e8</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>14cc474b-a821-4c28-bfc5-aa3e9688b38d</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e</id>
    <title>Analysis Report for e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e</title>
    <updated>2026-10-05T13:02:16Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39fe0d130e7ad452679f2</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac39fd782af77f74b7f6255</flow_id>
        <hash>e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e</hash>
        <iocs/>
        <name>WinSparkle.dll.exe</name>
        <report_id>2f3d1a47-e0f6-4257-83a6-79b72e41557f</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>stealer</value>
          <value>anti-debug</value>
          <value>masquerade</value>
          <value>microsoft_visual_cc</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>81a81ddf28ec57cdf657f6041f9d076778946b32d7b644b2c825888fffd05f1a</id>
    <title>Analysis Report for 81a81ddf28ec57cdf657f6041f9d076778946b32d7b644b2c825888fffd05f1a</title>
    <updated>2026-10-05T13:01:06Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39f99d130e7ad452679e4</_id>
        <file_type>image/jpeg</file_type>
        <flow_id>6ac39f9031f292eab9b51385</flow_id>
        <hash>81a81ddf28ec57cdf657f6041f9d076778946b32d7b644b2c825888fffd05f1a</hash>
        <iocs/>
        <name>image001.jpg</name>
        <report_id>c7dc9533-0f1f-463b-a26a-7a6dfc5d2a0b</report_id>
        <tags>
          <value>jpg</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a3215094193808969522b6d6259ffb67a0dbdec5fdad09e9c1abaf2b858f0d50</id>
    <title>Analysis Report for a3215094193808969522b6d6259ffb67a0dbdec5fdad09e9c1abaf2b858f0d50</title>
    <updated>2026-10-05T13:00:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39f97d130e7ad452679e3</_id>
        <file_type>text/x-vbscript</file_type>
        <flow_id>6ac39f70b242df12a78e2970</flow_id>
        <hash>a3215094193808969522b6d6259ffb67a0dbdec5fdad09e9c1abaf2b858f0d50</hash>
        <iocs/>
        <name>z29DraftFinancialStatements-25-26.vbs</name>
        <report_id>491021aa-b5e5-4701-8404-fda9e75f8e9f</report_id>
        <tags>
          <value>vbs</value>
          <value>downloader</value>
          <value>masquerade</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a0627090b99f9286bfba5fd90e29ffafc5549d2f4cdef22ef04e0e8e993be6d2</id>
    <title>Analysis Report for a0627090b99f9286bfba5fd90e29ffafc5549d2f4cdef22ef04e0e8e993be6d2</title>
    <updated>2026-10-05T13:00:18Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39f69d130e7ad452679d9</_id>
        <file_type>image/png</file_type>
        <flow_id>6ac39f6031f292eab9b5132a</flow_id>
        <hash>a0627090b99f9286bfba5fd90e29ffafc5549d2f4cdef22ef04e0e8e993be6d2</hash>
        <iocs/>
        <name>inky-injection-inliner-03755809cc10337ec572b1f12a6beedf.png</name>
        <report_id>b1fd4154-a3e8-4e98-a34d-d22753c0a6a6</report_id>
        <tags>
          <value>png</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>cb2e25797df01cb12182b38f561e53c02e697ff9d4d3f491ae3f39fa37dc174b</id>
    <title>Analysis Report for cb2e25797df01cb12182b38f561e53c02e697ff9d4d3f491ae3f39fa37dc174b</title>
    <updated>2026-10-05T12:59:36Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39f5ad130e7ad452679d4</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac39f3482af77f74b7f6069</flow_id>
        <hash>cb2e25797df01cb12182b38f561e53c02e697ff9d4d3f491ae3f39fa37dc174b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://blog.demofox.org/2022/01/01/interleaved-gradient-noise-a-different-kind-of-low-discrepancy-sequence</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.rs/egui/latest/egui/load/index.htmlImage</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/emilk/egui/issues</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/source-foundry</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/source-foundry/Hack/blob/master/LICENSE.md</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/source-foundry/HackThe</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.shadertoy.com/view/llVGzG</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>blog.demofox.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>docs.rs</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>github.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>shadertoy.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>192.0.78.13</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.20.21.173</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.121.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>151.101.129.91</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>95de04fb6514e2f763c4b1b88b2314382e2b89080086b87d02eb6587b620d80d</SHA-256>
              <SHA-1>9fadbccc35f9da95fe6f63b5a315eacbd2efa3b9</SHA-1>
              <MD5>fab5c11f370bba765f9fcf88617766b1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>a6a42c2f6bee71336af83012b3e3edc64e9e8df7f0d06420d644ff6bff33c030</SHA-256>
              <SHA-1>c0a46a48e983d111d39d4bf0f7c613fb088d75ad</SHA-1>
              <MD5>080cdc00bcbfe736959e2d611e01f037</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>cce85ef5a000e36442b2b1b9824a3f572df8e0ae33060b5e73f59028d4a73f15</SHA-256>
              <SHA-1>6d8f6eb3ed3289afeb4ff6667a451d44b1334217</SHA-1>
              <MD5>8d3fc6b04683859bab3af2e63c9ce9ac</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>cd0991dd595a1392452a8c7ccf089e73626bc6eed1fd3f54ee4c6aa7ffbaedba</SHA-256>
              <SHA-1>78bedd12a20f97e31e58742381f3d0ca1edb4715</SHA-1>
              <MD5>38388dda6548693f4d42f2241a4218d7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>d697073f92d83f078d2f3820617673f12d5f4fe2855f045c67269743ffc0ebed</SHA-256>
              <SHA-1>f0e235a38d12de8ffba39c7a94c3751cb05785d1</SHA-1>
              <MD5>716837a307eec624fbfb6a66c1443d75</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>917ef22f94f460141928531e1945453e29d89dcd58e3383c2b3ba0e2e19eb0d7</SHA-256>
              <SHA-1>70437a30a79f0032756805765a65aa52d05281d2</SHA-1>
              <MD5>0fc30646d5cf22910283967bf24ebf66</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>a1c41d15da309019c83996cbf0a3adc890d58f1b7c7b8d2b010742ff6df9bf35</SHA-256>
              <SHA-1>490faf292db05e5ed796a033d52a7df4c89c4bf9</SHA-1>
              <MD5>44628f7123ba823d9243e8c4e0058b5f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>43e443322e8e7b84c8b2f4a98bddfec0930531855d3ae65b64d2dc9a9377cab3</SHA-256>
              <SHA-1>cc08cdee8f0418402def27233e98d23a2da1b816</SHA-1>
              <MD5>f462ef84b5367c52cfdec0fdb8eb1d1e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>7fd58e2d6afd19fb68eda47f17865c9a831fa700064443b322e0ece6e5be3756</SHA-256>
              <SHA-1>d0af7ee772adf63c91b62b33f40eee975d32a599</SHA-1>
              <MD5>67a1e1feac77c03514a62e7e93074c89</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>2b69d32ea99c3fbc508057173fa7bf51538bca43957809568da50bc63162ef04</SHA-256>
              <SHA-1>cbf130ff5fc73d27e0bbd8312730592c3371f18a</SHA-1>
              <MD5>c441e706c0ad535df642e9dba489a8e1</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/zlib</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>bd6c5e1616961bd2d999bc0fe2161e810b8e33787884cda6932e92f06134fffd</SHA-256>
              <SHA-1>7b69fb0704561738bdd8fe15983e5d2e0b4b84ab</SHA-1>
              <MD5>cf7bcbbf20ef9b4a906f7f34ea3aa487</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>96f6b8f0b01be45e06191cc24e437e87d62366b23fd4169eb3f2fe457aea1752</SHA-256>
              <SHA-1>b467456a394941718158e5a5f00c766f91d67186</SHA-1>
              <MD5>560dc8c913a0127557f253090fd4d3d0</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/zlib</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>d2bd574682faba21e4e755604f008e069f476849a8b24981635fc30442043b1a</SHA-256>
              <SHA-1>2cd1267b2568b77a87b84dbe1ef0d943f0b95a7f</SHA-1>
              <MD5>050886929c5466177173cb37da5b54a1</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/zlib</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>mk-installer.exe</name>
        <report_id>d96ee7ea-f2ff-4ae5-88b0-1ed8a70bc450</report_id>
        <tags>
          <value>peexe</value>
          <value>txt</value>
          <value>html</value>
          <value>anti-vm</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>keylogger</value>
          <value>packed</value>
          <value>base64</value>
          <value>obfuscated</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>rust</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>93a46dc23c30b0dac84d2e85dcb2e9d0153fe2e5a61842797733abe80e15efcf</id>
    <title>Analysis Report for 93a46dc23c30b0dac84d2e85dcb2e9d0153fe2e5a61842797733abe80e15efcf</title>
    <updated>2026-10-05T12:58:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39ef5d130e7ad452679c1</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac39ee8b242df12a78e26de</flow_id>
        <hash>93a46dc23c30b0dac84d2e85dcb2e9d0153fe2e5a61842797733abe80e15efcf</hash>
        <iocs/>
        <name>ScanDocuments_1_17_3-1468_05.10.2026.pdf</name>
        <report_id>c6f3ca3e-2ac4-4ac2-9437-445ad87b4858</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>10bbea3735f89c1bf8d1de3b2a3a469e49188fc536fabb97930c9b570d30de92</id>
    <title>Analysis Report for 10bbea3735f89c1bf8d1de3b2a3a469e49188fc536fabb97930c9b570d30de92</title>
    <updated>2026-10-05T12:58:02Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39f0fd130e7ad452679c6</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39ed782af77f74b7f5f6d</flow_id>
        <hash>10bbea3735f89c1bf8d1de3b2a3a469e49188fc536fabb97930c9b570d30de92</hash>
        <iocs>
          <urls>
            <value>
              <url>https://abhishekbhosale.netlify.app/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://abhishekbhosale.netlify.app/#about</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://abhishekbhosale.netlify.app/#contact</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://abhishekbhosale.netlify.app/#experience</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://abhishekbhosale.netlify.app/#home</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://abhishekbhosale.netlify.app/#projects</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://abhishekbhosale.netlify.app/#skills</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://abhishekbhosale.netlify.app/.netlify/scripts/hud?variant=public</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://abhishekbhosale.netlify.app/assets/1788606967307.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://abhishekbhosale.netlify.app/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://abhishekbhosale.netlify.app/script.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://abhishekbhosale.netlify.app/style.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/all.min.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/webfonts/fa-brands-400.woff2</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/webfonts/fa-solid-900.woff2</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://github.com/abhishek205051</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://github.com/abhishek205051/Customers-Churn-Analysis</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://github.com/abhishek205051/Sales-Analysis-Dashboard-</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/in/abhishekbhosale205051/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:abhishekbhosale205051@gmail.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://abhishekbhosale.netlify.app/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/all.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://github.com/abhishek205051</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/abhishek205051/Customers-Churn-Analysis</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/abhishek205051/Sales-Analysis-Dashboard-</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/in/abhishekbhosale205051/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>abhishekbhosale.netlify.app</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cdnjs.cloudflare.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cdnjs.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>abhishekbhosale205051@gmail.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>104.18.41.41</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.17.24.14</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.110.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.14.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>63.176.8.218</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.17.25.14</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.121.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>5ceaaba22d75b58e04150311f596306562a3e595e27ed4b1dfa451b82dda9e50</SHA-256>
              <SHA-1>f2a96686228994a46961657df4c9405afec8e9c2</SHA-1>
              <MD5>c325be79a5ecca85d68eb9e5b65a547a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/css</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>3469da6f629038fe25b13810063172847496c1c366b9af7749e81b59b4f7a7fd</SHA-256>
              <SHA-1>df974d7fd659fe2a9096b1ace77ff4e484affe79</SHA-1>
              <MD5>00b3ab43babd7b53125ddd9319820bde</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>f2ebb07cbf6eddf331f8798849b9dbdc5df8835a357256a8c541e69aed7dc328</SHA-256>
              <SHA-1>80a27eff9a569bd73da9ef26134165fd0c57dfbc</SHA-1>
              <MD5>54be0604b1617855e1780e202b8f79ad</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>dba29f79c63c6f7b2f5dbeedb04130eb27c8a0227f4b3dcd979dd5a58bad4d4d</SHA-256>
              <SHA-1>01c24b54c58f2ae7fad1fa85e2d77159c1ce57fe</SHA-1>
              <MD5>f41f90d6c4dfaa11257cd51cf7e26e97</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>644031a68bde879af85bcc9cb3e6fa1e9a6b0f61d49307581974b5dbc09d3de8</SHA-256>
              <SHA-1>9176c614fa5aca9af6ceba4996cc9128842803f7</SHA-1>
              <MD5>895d2a337cecd4bf36e6ff9a7e669a63</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>dd8f3651-dc49-43c5-9224-b3db1a460dcc</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://abhishekbhosale.netlify.app/</name>
        <report_id>3a7e24f2-d886-448f-a9e7-ca95f1858c65</report_id>
        <tags>
          <value>html</value>
          <value>txt</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ea52bbd64b7418bc18daea57fb3195ec4283df4c720911b49e5880e5719db567</id>
    <title>Analysis Report for ea52bbd64b7418bc18daea57fb3195ec4283df4c720911b49e5880e5719db567</title>
    <updated>2026-10-05T12:57:53Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39ede89017dd18dc1c2ea</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39ed0b242df12a78e266f</flow_id>
        <hash>ea52bbd64b7418bc18daea57fb3195ec4283df4c720911b49e5880e5719db567</hash>
        <iocs>
          <urls>
            <value>
              <url>https://share.google/KAPY7C6k5EuEEQC2f</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>login-inbank.dashboard-manage.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-520/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing?utm_source=errorcode_520&amp;utm_campaign=login-inbank.dashboard-manage.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>developers.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://share.google/KAPY7C6k5EuEEQC2f</name>
        <report_id>752c7f79-dbfa-4871-b929-3362be15b1ab</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d180bdd562b0bd602e669f07e9340784d3e757d4cc392eb653ea344112897834</id>
    <title>Analysis Report for d180bdd562b0bd602e669f07e9340784d3e757d4cc392eb653ea344112897834</title>
    <updated>2026-10-05T12:57:52Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39ed7d130e7ad452679b9</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39ecb31f292eab9b5124e</flow_id>
        <hash>d180bdd562b0bd602e669f07e9340784d3e757d4cc392eb653ea344112897834</hash>
        <iocs>
          <urls>
            <value>
              <url>login-inbank.dashboard-manage.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-520/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing?utm_source=errorcode_520&amp;utm_campaign=login-inbank.dashboard-manage.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://share.google/KAPY7C6k5EuEEQC2f</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>developers.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://share.google/KAPY7C6k5EuEEQC2f</name>
        <report_id>fc9b1e62-01e6-48c7-b444-28b997a19882</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>54e173be753d03b2c163cebbee02be7f4bdc1d6663154d4d60a3833f7ba3436b</id>
    <title>Analysis Report for 54e173be753d03b2c163cebbee02be7f4bdc1d6663154d4d60a3833f7ba3436b</title>
    <updated>2026-10-05T12:57:29Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39eced130e7ad452679b7</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39eb731f292eab9b5122b</flow_id>
        <hash>54e173be753d03b2c163cebbee02be7f4bdc1d6663154d4d60a3833f7ba3436b</hash>
        <iocs>
          <urls>
            <value>
              <url>http://email.versapay.com/ls/click?upn=u001.zYiBgFg9bCfBqtV3ylE2LYYASu9aPmyVkz9TFrmWd7Bp8b1amhsyOe48SN-2Fjn9kcDVRnH6XFj9jgvdcRnHTHYw-3D-3D9JdI_Jpn-2B0XSrG1AxhkqzRWEfYmYurzzL76-2BEbFg43fifq2wYOF7IubN8N7IglQHx6ac11IelbEyWS0UlmIfegc3G-2BR-2BGRrO6qwuNwWzu-2FYSq5rrrRFsQ-2ByVInTIpK4Q3NiX9mzT2V1C6ZGkcTiFfsFdi1oDa7onvWPvlZx0xmRP2TodtonJJEOlbd6upMFOMB16M6dW5fCBM8SUcqk-2BI0oQH7QGK-2F4yE0viQIM02gEpZ1qBx1oDBsK8uIxNCTTqyKGjoQRD7g86JWT13hAqu69rdhWhcrfbKjv5-2FDoT8nMABxRQ5OVPxLZM-2BeybaPUjJPEHlIaqW3HYvvbWmBy5RLBx6Tw-3D-3D__;!!AaG5Gbqq9twG!VohA-L0Mf8kZxnGbwC-LIyEMKNfLhvP4HE0SwumAcaeGSdAolpA9Z7QRnd4Qzt2yKoySgmzZuaFExkTILKOqqDjJkhA63ELBcPZhHzk$</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://email.versapay.com/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://email.versapay.com/ls/click?upn=u001.zYiBgFg9bCfBqtV3ylE2LYYASu9aPmyVkz9TFrmWd7Bp8b1amhsyOe48SN-2Fjn9kcDVRnH6XFj9jgvdcRnHTHYw-3D-3D9JdI_Jpn-2B0XSrG1AxhkqzRWEfYmYurzzL76-2BEbFg43fifq2wYOF7IubN8N7IglQHx6ac11IelbEyWS0UlmIfegc3G-2BR-2BGRrO6qwuNwWzu-2FYSq5rrrRFsQ-2ByVInTIpK4Q3NiX9mzT2V1C6ZGkcTiFfsFdi1oDa7onvWPvlZx0xmRP2TodtonJJEOlbd6upMFOMB16M6dW5fCBM8SUcqk-2BI0oQH7QGK-2F4yE0viQIM02gEpZ1qBx1oDBsK8uIxNCTTqyKGjoQRD7g86JWT13hAqu69rdhWhcrfbKjv5-2FDoT8nMABxRQ5OVPxLZM-2BeybaPUjJPEHlIaqW3HYvvbWmBy5RLBx6Tw-3D-3D__;!!AaG5Gbqq9twG!VohA-L0Mf8kZxnGbwC-LIyEMKNfLhvP4HE0SwumAcaeGSdAolpA9Z7QRnd4Qzt2yKoySgmzZuaFExkTILKOqqDjJkhA63ELBcPZhHzk$</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>email.versapay.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.18.38.91</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxp://email.versapay.com/ls/click?upn=u001.zYiBgFg9bCfBqtV3ylE2LYYASu9aPmyVkz9TFrmWd7Bp8b1amhsyOe48SN-2Fjn9kcDVRnH6XFj9jgvdcRnHTHYw-3D-3D9JdI_Jpn-2B0XSrG1AxhkqzRWEfYmYurzzL76-2BEbFg43fifq2wYOF7IubN8N7IglQHx6ac11IelbEyWS0UlmIfegc3G-2BR-2BGRrO6qwuNwWzu-2FYSq5rrrRFsQ-2ByVInTIpK4Q3NiX9mzT2V1C6ZGkcTiFfsFdi1oDa7onvWPvlZx0xmRP2TodtonJJEOlbd6upMFOMB16M6dW5fCBM8SUcqk-2BI0oQH7QGK-2F4yE0viQIM02gEpZ1qBx1oDBsK8uIxNCTTqyKGjoQRD7g86JWT13hAqu69rdhWhcrfbKjv5-2FDoT8nMABxRQ5OVPxLZM-2BeybaPUjJPEHlIaqW3HYvvbWmBy5RLBx6Tw-3D-3D__;!!AaG5Gbqq9twG!VohA-L0Mf8kZxnGbwC-LIyEMKNfLhvP4HE0SwumAcaeGSdAolpA9Z7QRnd4Qzt2yKoySgmzZuaFExkTILKOqqDjJkhA63ELBcPZhHzk$</name>
        <report_id>c2e71fa8-7ad0-42ee-8b08-e05d677693b4</report_id>
        <tags>
          <value>html</value>
          <value>aidetect</value>
          <value>phishing</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>756e32e72591a987d92d2442094c23d59f864789f926ace0deabebfa7e8c167d</id>
    <title>Analysis Report for 756e32e72591a987d92d2442094c23d59f864789f926ace0deabebfa7e8c167d</title>
    <updated>2026-10-05T12:57:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39ed0d130e7ad452679b8</_id>
        <file_type>application/x-msdownload; format=pe64</file_type>
        <flow_id>6ac39eaab242df12a78e25af</flow_id>
        <hash>756e32e72591a987d92d2442094c23d59f864789f926ace0deabebfa7e8c167d</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>a73f26a8d504043f785d7360e8febf2eeb8522ec873a0d4dd5d1d4bfd1e67d3d</SHA-256>
              <SHA-1>6c93b8c5fde8be4b2231dca6b8ec513cdc82c991</SHA-1>
              <MD5>5aa04ce935e78505e230765e85c34355</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>d691e45fd81ee57c7d83d70eab917c91b0502b84fbd0d7258cebfeb86f17a8b2</SHA-256>
              <SHA-1>d070cdd3ba01269f5fed261b010176f112a3fdc9</SHA-1>
              <MD5>7d1689ddaf5cb169be9ebf5a3a8b4e2c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>Quanticade.exe</name>
        <report_id>239344d2-0e35-410a-8525-3dd38518d71b</report_id>
        <tags>
          <value>peexe</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>overlay</value>
          <value>crypto</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9c40652739b80dc1ab87b447fde0d4956f362a956138173baddf4b37878af0b9</id>
    <title>Analysis Report for 9c40652739b80dc1ab87b447fde0d4956f362a956138173baddf4b37878af0b9</title>
    <updated>2026-10-05T12:55:19Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39e73d130e7ad452679a5</_id>
        <file_type>text/javascript</file_type>
        <flow_id>6ac39e352ec57dc148277357</flow_id>
        <hash>9c40652739b80dc1ab87b447fde0d4956f362a956138173baddf4b37878af0b9</hash>
        <iocs>
          <urls>
            <value>
              <url>http://luajit.org/</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>luajit.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>163.172.177.144</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>2df88c5e3730d5a1cca00fbd1a2d28e594de3b80fb305e1e3a01295e287da6be</SHA-256>
              <SHA-1>b9270c4f613e3becea0a5a6352971df2fc6a3c09</SHA-1>
              <MD5>ebf698f98023235e8ad24fcea7cef77e</MD5>
              <origin>JAVASCRIPT_EMULATION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>873868a93c7b0625e8f0c61e8bca0ed289c2bd9ecfe6e673f0d52da0d9ef7050</SHA-256>
              <SHA-1>72144c5f117711af81b53e8065b3241252e5cb9a</SHA-1>
              <MD5>90f4868f90672599d7539f40acc72a02</MD5>
              <origin>JAVASCRIPT_EMULATION</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>a73f26a8d504043f785d7360e8febf2eeb8522ec873a0d4dd5d1d4bfd1e67d3d</SHA-256>
              <SHA-1>6c93b8c5fde8be4b2231dca6b8ec513cdc82c991</SHA-1>
              <MD5>5aa04ce935e78505e230765e85c34355</MD5>
              <origin>JAVASCRIPT_EMULATION</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49</SHA-256>
              <SHA-1>145c72f8acdcd366869f955dffd000d3bc146b6e</SHA-1>
              <MD5>7675b38aabebc8427171447edd484b5b</MD5>
              <origin>JAVASCRIPT_EMULATION</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>66c50d2a5ba0a96d30be3d64fcdf344912799375fcd093735824af43ab991e87</SHA-256>
              <SHA-1>3212975408dc753eaa6ceff270a107fafc862aeb</SHA-1>
              <MD5>f853f444a788183296e243a0af587288</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>SWFT.JS.js</name>
        <report_id>6e75eaa1-91ab-4172-b8fa-09e4da2b42c1</report_id>
        <tags>
          <value>javascript</value>
          <value>html</value>
          <value>obfuscated</value>
          <value>dropper</value>
          <value>evasive</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>repaired</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8ad1e81b511ad76a0dca74d39d82b8d7932d584d2047fb602b1ae4dd2eb6bada</id>
    <title>Analysis Report for 8ad1e81b511ad76a0dca74d39d82b8d7932d584d2047fb602b1ae4dd2eb6bada</title>
    <updated>2026-10-05T12:54:18Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39e67d130e7ad452679a2</_id>
        <file_type>text/x-msdos-batch</file_type>
        <flow_id>6ac39df882af77f74b7f5d4a</flow_id>
        <hash>8ad1e81b511ad76a0dca74d39d82b8d7932d584d2047fb602b1ae4dd2eb6bada</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>22ade7e71d12c6e435fdfb50f311c4d0bc91c8d242fbfaef099bf38bccf44f39</SHA-256>
              <SHA-1>08b7cc27fa942b8222540d056e44a43a71064541</SHA-1>
              <MD5>638611868b49aeb54fafc3654c56c025</MD5>
              <origin>VBA_EMULATION</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>208bd54e0a4cc5b32ddcab512e14eab815b73a45d66fd8295d33d8cdeaa77ce6</SHA-256>
              <SHA-1>bb774009be8743404ccd22ae434f1e51d8dfdd30</SHA-1>
              <MD5>6c312572283abad1be8588d5048e626f</MD5>
              <origin>BATCH_SCRIPT_EMULATION</origin>
              <file_type>text/plain</file_type>
            </value>
          </files>
        </iocs>
        <name>limclean.bat</name>
        <report_id>02ee8186-9b46-415c-a74d-d541e63cf3b4</report_id>
        <tags>
          <value>bat</value>
          <value>anti-vm</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>275fe8668fcb35ed66c925ea665a399a4d50498778e6f1e828a5f0d6756896bb</id>
    <title>Analysis Report for 275fe8668fcb35ed66c925ea665a399a4d50498778e6f1e828a5f0d6756896bb</title>
    <updated>2026-10-05T12:50:59Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39d3fd130e7ad45267969</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac39d31b242df12a78e1da5</flow_id>
        <hash>275fe8668fcb35ed66c925ea665a399a4d50498778e6f1e828a5f0d6756896bb</hash>
        <iocs>
          <urls>
            <value>
              <url>http://ip.ifconfig.dpdns.org/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <ips>
            <value>
              <ip>172.71.247.237</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>63.177.146.192</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.71.247.237</ip>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>63.177.146.192</ip>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
        </iocs>
        <name>hxxp://ip.ifconfig.dpdns.org/</name>
        <report_id>a38e85aa-1d82-4a17-8b17-ce4466409614</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e4e2fe24042d6a0d871b91371b8a228b5f261776944c7953db38ee2b9be71313</id>
    <title>Analysis Report for e4e2fe24042d6a0d871b91371b8a228b5f261776944c7953db38ee2b9be71313</title>
    <updated>2026-10-05T12:49:54Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39cfe89017dd18dc1c296</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39cf0b242df12a78e1c90</flow_id>
        <hash>e4e2fe24042d6a0d871b91371b8a228b5f261776944c7953db38ee2b9be71313</hash>
        <iocs>
          <urls>
            <value>
              <url>https://share.google/KAPY7C6k5EuEEQC2f</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>login-inbank.dashboard-manage.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-520/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing?utm_source=errorcode_520&amp;utm_campaign=login-inbank.dashboard-manage.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>developers.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://share.google/KAPY7C6k5EuEEQC2f</name>
        <report_id>d2195a03-5b04-4ba3-a4d2-5ba23de35d90</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>3ab2f76cd0d46233124393462ab28e1b165451228a6866e168309d246ad6803c</id>
    <title>Analysis Report for 3ab2f76cd0d46233124393462ab28e1b165451228a6866e168309d246ad6803c</title>
    <updated>2026-10-05T12:49:52Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39cf7d130e7ad45267950</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39cebb242df12a78e1c81</flow_id>
        <hash>3ab2f76cd0d46233124393462ab28e1b165451228a6866e168309d246ad6803c</hash>
        <iocs>
          <urls>
            <value>
              <url>https://share.google/KAPY7C6k5EuEEQC2f</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>login-inbank.dashboard-manage.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-520/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing?utm_source=errorcode_520&amp;utm_campaign=login-inbank.dashboard-manage.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>developers.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://share.google/KAPY7C6k5EuEEQC2f</name>
        <report_id>b354be77-4729-4ecd-aecf-b6fd184e38c5</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>c03b868691166338a531c45a89f1c65de6de1a0a2852328f84be88be8a79cb58</id>
    <title>Analysis Report for c03b868691166338a531c45a89f1c65de6de1a0a2852328f84be88be8a79cb58</title>
    <updated>2026-10-05T12:49:47Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39d1ed130e7ad4526795e</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6ac39ce9edc8b0d17b0040d9</flow_id>
        <hash>c03b868691166338a531c45a89f1c65de6de1a0a2852328f84be88be8a79cb58</hash>
        <iocs>
          <urls>
            <value>
              <url>file:///tmp/tmppsxmx6n1.html</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <files>
            <value>
              <SHA-256>2e2baacba5f1f7d0954715bf51107dc5e5315d7a7e7cb8ae12d62422f7c8274a</SHA-256>
              <SHA-1>59f4fb796a6327a66fcd889c9927068b6a757575</SHA-1>
              <MD5>7ef434c642b9f588c9a1aa8d13832f80</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/html</file_type>
            </value>
          </files>
        </iocs>
        <name>submission.eml</name>
        <report_id>8f1df181-3d6d-4212-bba2-6db3051a6c33</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>fce20206059d8255440bfa6704d44c72bf93c5bda993bb494c1614219df2ebbb</id>
    <title>Analysis Report for fce20206059d8255440bfa6704d44c72bf93c5bda993bb494c1614219df2ebbb</title>
    <updated>2026-10-05T12:49:16Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39cd3d130e7ad45267944</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6ac39ccab242df12a78e1b7b</flow_id>
        <hash>fce20206059d8255440bfa6704d44c72bf93c5bda993bb494c1614219df2ebbb</hash>
        <iocs>
          <ips>
            <value>
              <ip>176.65.139.140</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
        </iocs>
        <name>spc.elf</name>
        <report_id>cc293d48-cf91-4b21-85ba-5538edcbceb1</report_id>
        <tags>
          <value>elf</value>
        </tags>
        <verdict>UNKNOWN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a046c9d069a051587e7c310aeca1ace249bb414edb371aa38f46b812549dc773</id>
    <title>Analysis Report for a046c9d069a051587e7c310aeca1ace249bb414edb371aa38f46b812549dc773</title>
    <updated>2026-10-05T12:49:16Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39cefd130e7ad4526794c</_id>
        <file_type>application/vnd.android.package-archive</file_type>
        <flow_id>6ac39ccab242df12a78e1b7f</flow_id>
        <hash>a046c9d069a051587e7c310aeca1ace249bb414edb371aa38f46b812549dc773</hash>
        <iocs>
          <urls>
            <value>
              <url>https://developer.android.com/guide/topics/media/issues/player-accessed-on-wrong-thread</url>
              <origin>APK_DECODING</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/mm</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/sType/ResourceRef</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://developer.android.com/guide/topics/media/issues/cleartext-not-permitted</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>developer.android.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>ns.adobe.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>developer.android.com</url>
              <origin>APK_DECODING</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>0@com.android.externalstorage.documents</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>support@dropbox.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>127.0.0.1</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>192.168.43.1</ip>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <ip>142.250.154.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
        </iocs>
        <name>Cx-FileExplorer-2.7.8.apk</name>
        <report_id>6ad0d106-c85d-49e0-bb20-88088b48bc60</report_id>
        <tags>
          <value>apk</value>
          <value>signed</value>
          <value>expand</value>
          <value>explorer</value>
          <value>lolbin</value>
          <value>persistence</value>
          <value>base64</value>
          <value>crypto</value>
          <value>evasive</value>
          <value>fingerprint</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>6f0ab1bf5899e04c5b2948709cded88753b0f1ed744a3ca530a4def680974625</id>
    <title>Analysis Report for 6f0ab1bf5899e04c5b2948709cded88753b0f1ed744a3ca530a4def680974625</title>
    <updated>2026-10-05T12:48:25Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39ca6d130e7ad45267937</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac39c98b242df12a78e1a9b</flow_id>
        <hash>6f0ab1bf5899e04c5b2948709cded88753b0f1ed744a3ca530a4def680974625</hash>
        <iocs>
          <ips>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>20c6e123d09ce23fbe849ed1673063a5e11d94d073c42a9ff60e0d187302e2c2</SHA-256>
              <SHA-1>c840dffb4327c0d1ce28fbd2a006221d1c81a1bd</SHA-1>
              <MD5>2056873436e382786e2d752f2cc30425</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>6a2cf379aa950dde3136a3e3ff80047923faaf69dc65c7c5af21350f6d6a2a08</SHA-256>
              <SHA-1>c2844e969091e2abc3ededb9792e7c129c050e1c</SHA-1>
              <MD5>fd46cae204161f624089374d1892677e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>17001d24117cb9844b721063bb19da56cd2fd65a91a1625aa4f9d09b03aa6153</SHA-256>
              <SHA-1>ad884922a83d55ba7a699d216c693817dc1594ae</SHA-1>
              <MD5>eb3498d0aabfd352d902ac591f531496</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>3e5c5ce951b57fa0ac75ed778544a4e5acb5c0b76661afd21f8b40f6b6cd540c</SHA-256>
              <SHA-1>741ee76a086f7705235fc5d0a9b5c7c883542083</SHA-1>
              <MD5>4cbd5539cb71d73be9e84c336829a957</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>6a894d8e-8db5-4a88-8f16-691896f22786</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>ConstantDecrypter.exe</name>
        <report_id>edcee298-9daa-49fb-9ef6-0c4c424c26a9</report_id>
        <tags>
          <value>peexe</value>
          <value>dotnet_pe</value>
          <value>obfuscated</value>
          <value>hacktool</value>
          <value>base64</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>12e2fec72d2178505dcd0802fb9630d256794fe2524eb1d526d35d59c51189c8</id>
    <title>Analysis Report for 12e2fec72d2178505dcd0802fb9630d256794fe2524eb1d526d35d59c51189c8</title>
    <updated>2026-10-05T12:46:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39c4ad130e7ad4526791b</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39c292ec57dc148277318</flow_id>
        <hash>12e2fec72d2178505dcd0802fb9630d256794fe2524eb1d526d35d59c51189c8</hash>
        <iocs>
          <urls>
            <value>
              <url>https://wechall.net</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://bsky.app/profile/celphase.bsky.social</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/TecharoHQ/anubis</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://techaro.lol</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://3564020356.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://hackbbs.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://pwnable.kr/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://reversing.kr</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://suninatas.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://warzone.elhacker.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.bright-shadows.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.caesum.com/game</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.hacking-challenges.de</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.net-force.nl</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.trythis0ne.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.wechall.net/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://247ctf.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ae27ff.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://codeshell.kr/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cryptohack.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enigmes-a-thematiques.fr</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://gekko.csokavar.hu</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://gemforgelabs.io/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://github.com/gizmore/gwf3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://github.com/gizmore/gwf3/commits/master</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://hack.arrrg.de/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://hackmyvm.eu/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://hacknroll.dev/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mrradio.kr/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mysterytwister.org/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://promptriddle.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://pwn.college/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://pwnable.tw</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://pydefis.callicode.fr</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://redtiger.labs.overthewire.org/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ringzer0ctf.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://w3challs.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://webhacking.kr</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://websec.co.il/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://wechall.net#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://wechall.net/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://wechall.net/.within.website/x/cmd/anubis/static/img/happy.webp?cacheBuster=v1.27.0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://wechall.net/.within.website/x/cmd/anubis/static/img/pensive.webp?cacheBuster=v1.27.0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://wechall.net/.within.website/x/cmd/anubis/static/js/main.mjs?cacheBuster=v1.27.0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://wechall.net/.within.website/x/cmd/anubis/static/js/worker/sha256-webcrypto.mjs?cacheBuster=v1.27.0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://wechall.net/.within.website/x/cmd/anubis/static/locales/en.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://wechall.net/.within.website/x/xess/xess.min.css?cachebuster=v1.27.0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://wow.sinfocol.org/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.brainquest.sk</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.hacker.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.hackthebox.eu</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.hackthissite.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.newbiecontest.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.overthewire.org/wargames/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.rankk.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.revolutionelite.co.uk</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.root-me.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.spoj.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.tdhack.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.trytodecrypt.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/img/default/delete.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/js/gwf3.js?v=57</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/js/gwf3bb.js?v=58</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/js/jquery-2.1.4.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/js/module/Heart/hb.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/js/module/WeChall/wc.js?v=5.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/js/php.js?v=57</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/tpl/default/css/gwf3.css?v=58</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/tpl/wc4/css/wechall4.css?v=58</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/tpl/wc4/img/banner_shade.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/tpl/wc4/img/grad.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/tpl/wc4/img/icon_pass.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/tpl/wc4/img/icon_user.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/tpl/wc4/img/logo_wc4.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/tpl/wc4/img/title_shade.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/tpl/wc4/img/topmenu_shade.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wechall.net/tpl/wc4/img/topmenu_shadeR.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://yoire.com/</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>247ctf.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>3564020356.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ae27ff.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>codeshell.kr</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cryptohack.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>enigmes-a-thematiques.fr</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>gekko.csokavar.hu</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>gemforgelabs.io</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>hack.arrrg.de</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>hackbbs.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>hackmyvm.eu</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>hacknroll.dev</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mrradio.kr</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mysterytwister.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>promptriddle.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>pwn.college</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>pwnable.kr</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>pwnable.tw</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>pydefis.callicode.fr</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>redtiger.labs.overthewire.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>reversing.kr</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ringzer0ctf.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>suninatas.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>w3challs.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>warzone.elhacker.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>webhacking.kr</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>websec.co.il</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>wechall.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>wow.sinfocol.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.brainquest.sk</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.bright-shadows.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.caesum.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.hacker.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.hacking-challenges.de</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.hackthebox.eu</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.hackthissite.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.net-force.nl</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.newbiecontest.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.overthewire.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.rankk.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.revolutionelite.co.uk</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.root-me.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.spoj.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.tdhack.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.trythis0ne.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.trytodecrypt.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.wechall.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>yoire.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>bsky.app</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>techaro.lol</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>xe.iaso@techaro.lol</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>185.80.92.41</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>3.147.179.92</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.121.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>216.128.177.63</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>bff94a6f3786ba063dd3dce5a27ca6b39edc6ae6d1051ece826a97c2b7e19851</SHA-256>
              <SHA-1>db195a0229518031c2021d3029e66dfe996846e9</SHA-1>
              <MD5>edc46181ee0a1d1f3d393e9feabbb513</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>bfa22ae94cf7bc5a20437a808e82bc3795c56fefb61681b439a599acdf75d9ad</SHA-256>
              <SHA-1>4719aefbb3ec40931cba7812ba0b99e371789542</SHA-1>
              <MD5>8be310bad4c18b8f7f0caff95effedea</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>29c7af423297ba09bab4a1283cb8b727338e0661db8be71a45e8c279c20a5be7</SHA-256>
              <SHA-1>5e712d8111f9b7425d52d13d2ff5a64682e6d555</SHA-1>
              <MD5>274014251684df0dd46e5c2c3e0405d9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>01a10c1a-043c-7a6b-8134-0aea137d5a8a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>98dfb3c0-132f-43fb-9d57-0380726c2077</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://wechall.net</name>
        <report_id>5e2f447d-b113-450a-8244-6a8606a4579e</report_id>
        <tags>
          <value>html</value>
          <value>obfuscated</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f68c1f1309af5244919e6051f4840c5a4d0ac495e90d4d7630fa0c2e46f4e24b</id>
    <title>Analysis Report for f68c1f1309af5244919e6051f4840c5a4d0ac495e90d4d7630fa0c2e46f4e24b</title>
    <updated>2026-10-05T12:44:48Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39bdfd130e7ad452678fd</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac39bbf82af77f74b7f581c</flow_id>
        <hash>f68c1f1309af5244919e6051f4840c5a4d0ac495e90d4d7630fa0c2e46f4e24b</hash>
        <iocs>
          <ips>
            <value>
              <ip>10.65.139.179</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>10.65.139.179</ip>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </ips>
        </iocs>
        <name>ip.txt</name>
        <report_id>456240cc-e8eb-4722-a85f-60e1bb9b2913</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>4544bb72d993c37876224d524ec5a0900c149d098d50399900d97edb89f4c4b8</id>
    <title>Analysis Report for 4544bb72d993c37876224d524ec5a0900c149d098d50399900d97edb89f4c4b8</title>
    <updated>2026-10-05T12:44:27Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39bedd130e7ad45267901</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6ac39ba9b242df12a78e1528</flow_id>
        <hash>4544bb72d993c37876224d524ec5a0900c149d098d50399900d97edb89f4c4b8</hash>
        <iocs>
          <urls>
            <value>
              <url>file:///tmp/tmpuyfh7w50.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1Dy6CXAedBpGeOk9F9IGxkQqkmLN2OtV</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1ML_jHxVvytcDXLcnSORBOnNne4rog4D</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1oEuSAZ6thfZEuREUkdzkOewgGRzwohE</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/11tUI08vAatsCxXQ_n4VieyvTfNVMtYtiPPwerj7dN0Q/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1Dy6CXAedBpGeOk9F9IGxkQqkmLN2OtV1s8h28uqQVfk/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1ML_jHxVvytcDXLcnSORBOnNne4rog4Dtc6ElRTbpw2Q/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1oEuSAZ6thfZEuREUkdzkOewgGRzwohE5F4DSufjFeOQ/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/11tUI08vAatsCxXQ_n4VieyvTfNVMtYtiPPwerj7dN0Q/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1Dy6CXAedBpGeOk9F9IGxkQqkmLN2OtV1s8h28uqQVfk/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1ML_jHxVvytcDXLcnSORBOnNne4rog4Dtc6ElRTbpw2Q/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1oEuSAZ6thfZEuREUkdzkOewgGRzwohE5F4DSufjFeOQ/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>docs.google.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>docs.google.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>docs.google.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.13.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>26024a6bde4d0670acdaaa5c26fb18deaced2d2184304ea14105003dc35a7b56</SHA-256>
              <SHA-1>fbb46e0d27976cd022b0c82a41e399ea72a208d5</SHA-1>
              <MD5>6be7841032033bd0d8c17710aa6898d1</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/html</file_type>
            </value>
            <value>
              <SHA-256>8556ec9cbb093c6f59843088d43483c429ca6306991ab972604993c1bb0d8aa4</SHA-256>
              <SHA-1>bf156c26f907a35ac1db2c79b43ceb44de6a36ca</SHA-1>
              <MD5>7f76f3970ec7849673bfcdb1ed22fc7d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>e636e19e139b6b47c2cd29b1d6a71473f3e6be4e9e38820007312537e8a113b6</SHA-256>
              <SHA-1>8cacdda6588b8614ee4dcba9f8099f58783528ce</SHA-1>
              <MD5>acf0f2086f6f8fb27a4fc88c31b017e2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>5acee5e2d9d44edec9031a0a9c9a367e79d391bee036e63fc18597b7bd05b53c</SHA-256>
              <SHA-1>8f3d043a6d3076eca2ad5bcc09f643d7e7f02ecc</SHA-1>
              <MD5>fca121fa489458a56b45a7a83ddf3559</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>270f2b1fde63ae59b884cc414c02efc81bb3391ef3a2aeec623504feee197c9c</SHA-256>
              <SHA-1>936d1e4eea2d7d9e81aa390ccf06c0f0baafa570</SHA-1>
              <MD5>fa0c2840502a1d8d588d4d033339fc08</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>887474784ba105256e85f2aa4d54e722e1fc2ec7d7234713806c938f0e01a014</SHA-256>
              <SHA-1>190e467cda5d50f711c67db086a17c8f1b028243</SHA-1>
              <MD5>83748b2700b78ac70e6a570df6e574fa</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>9a081d0b26e9b52a9eed18a76d8fe8045ab3e47f3d3753139a50ad6d3b90c9a8</SHA-256>
              <SHA-1>79aa41818da1d8de30424d46eae56115f72ab4d2</SHA-1>
              <MD5>9cab47c3136990ef0cd2d8cc88d44616</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>4b6473bcfe11bce04ee42b3e24fc5ed8ea988f3712bf876ecad1c18fbab7496e</SHA-256>
              <SHA-1>4de8308f791c4c7121a7371984eb80c97be82c61</SHA-1>
              <MD5>b5507c8a2741415c7f1f4898aa6d42b3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>submission.eml</name>
        <report_id>8e4185cf-b709-41b6-b83c-dbc2e4cdcdbd</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e324859ef5c89af32a78534a2bdd24abc4479e22970dc8d0c732265e27cf6655</id>
    <title>Analysis Report for e324859ef5c89af32a78534a2bdd24abc4479e22970dc8d0c732265e27cf6655</title>
    <updated>2026-10-05T12:44:11Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39bced130e7ad452678f5</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39b99b242df12a78e1479</flow_id>
        <hash>e324859ef5c89af32a78534a2bdd24abc4479e22970dc8d0c732265e27cf6655</hash>
        <iocs>
          <urls>
            <value>
              <url>https://a.docusign.com/f</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://apps.docusign.com/api/esign/na1/Signing/DocuSignXML.aspx?ti=3a937140e8d84dec853cd1edc2bd46fd&amp;auditView=1&amp;tm=1791204263307&amp;sb=0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://apps.docusign.com/api/esign/na1/Signing/RasterizerImage.aspx?ti=3a937140e8d84dec853cd1edc2bd46fd&amp;p=1&amp;d=96&amp;pid=623e0a03-614f-48c3-bfda-ec840e84af8b&amp;vm=true</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://apps.docusign.com/api/esign/na1/Signing/envelope/brand?locale=en&amp;ti=3a937140e8d84dec853cd1edc2bd46fd</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://apps.docusign.com/api/esign/na1/Signing/envelope?ti=3a937140e8d84dec853cd1edc2bd46fd</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://apps.docusign.com/api/esign/na1/Signing/envelopes/94eca7de-2f46-81d4-82e2-c77399b97f86/recipients/1e79abd0-adc2-88f9-8252-1e97ef39c8ee/participant-token?ti=3a937140e8d84dec853cd1edc2bd46fd</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://apps.docusign.com/api/esign/na1/Signing/extensions/?ti=3a937140e8d84dec853cd1edc2bd46fd</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://apps.docusign.com/authenticate</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://apps.docusign.com/authenticate?code=eyJ0eXAiOiJNVCIsImFsZyI6IlJTMjU2Iiwia2lkIjoiOGFlYzFjZjQtYmE4NS00MDM5LWE1MmItYzVhODAxMjA3N2EyIn0.AQYAAAABAAMABwCA03xf3iLfSAgAgHOO5v8i30gYAAEAAAAAAAAAIQBfAgAAeyJUb2tlbklkIjoiYzMyZjkwZDAtOGYyMy00MzZhLWFlNTctN2Q1MDgxZGRkZjAxIiwiRXhwaXJhdGlvbiI6IjIwMjYtMTAtMDVUMTI6NDk6MTgrMDA6MDAiLCJJc3N1ZWRBdCI6IjIwMjYtMTAtMDVUMTI6NDQ6MTkuMDE2MjE2MyswMDowMCIsIlJlc291cmNlSWQiOiIzYTkzNzE0MGU4ZDg0ZGVjODUzY2QxZWRjMmJkNDZmZCIsIlJlc291cmNlcyI6IntcIlNzaWRcIjpcIjFhaWd2azFsbWdmcnpuYXUwcnNkbmlvMFwiLFwiUGVyc2lzdGVuY2VWYWx1ZVwiOlwiRTJFU0UxRkUyM1AyNl84ODEyXCIsXCJTcmNcIjo4LFwiRW52ZWxvcGVJZFwiOlwiOTRlY2E3ZGUtMmY0Ni04MWQ0LTgyZTItYzc3Mzk5Yjk3Zjg2XCIsXCJXb3JraW5nVHJhbklkXCI6XCIzYTkzNzE0MGU4ZDg0ZGVjODUzY2QxZWRjMmJkNDZmZFwifSIsIlRva2VuVHlwZSI6MSwiQXVkaWVuY2UiOiIyNWUwOTM5OC0wMzQ0LTQ5MGMtOGU1My0zYWIyY2E1NjI3YmYiLCJSZWRpcmVjdFVyaSI6Imh0dHBzOi8vd3d3LmRvY3VzaWduLm5ldC9TaWduaW5nL1N0YXJ0SW5TZXNzaW9uLmFzcHgiLCJIYXNoQWxnb3JpdGhtIjowLCJIYXNoUm91bmRzIjowLCJUb2tlblN0YXR1cyI6MCwiSXNTaW5nbGVVc2UiOmZhbHNlfT8AgAQcEd8i30g.I9MPgA-dUj9zJV8uSxDBkt3QKCDZO-QvygWNQXz-qAPaeVa8ePApV_l38XCEu_wvPYnONusCjWe6zpuKFbu2Vnx5NVJrhJxLptsF9bBmBpIgI8laREF4-DCkMncUlc5pFUpMyVow8w63S0W3w3wj2w0xMkM2gOc99KAmlrHrGa0yudInUAaxtNycKNbgpMJH59KogoUYo5wyeU8JbZEhEab0iYWz9W7cBR73zojMy2KDGPk4ySoV40oE8Z9_pBwT5asgRUVDuGWrdxAYxjovjSXWBWXUbvEpiXWWhQcWoGhQ8LE2WY6x5A6lKrw2H7LMA1CpK957IV34CAB9doP4ig&amp;state=%7B%22widgetId%22%3A%22%40sign%2Fplugin%22%2C%20%22redirectUri%22%3A%20%22%2Fsign%2Fapp%3Fti%3D3a937140e8d84dec853cd1edc2bd46fd%26signing-config%3D%257B%2522SigningAppDisabledFlags%2522%253A%2522%2522%252C%2522NotaryFetchSettings%2522%253A%257B%2522LiveoakTokenRequestTimeoutSeconds%2522%253A30%252C%2522EnableRemoteNotaryAuth%2522%253Atrue%252C%2522IsThirdPartyNotary%2522%253Afalse%252C%2522LiveoakTokenExchangeOrigin%2522%253A%2522%2522%257D%252C%2522WebFormsSettings%2522%253Anull%252C%2522OneDSMessagingOrigins%2522%253Anull%252C%2522FocusedViewSource%2522%253Anull%257D%26site%3Dwww.docusign.net%22%20%7D&amp;callbackURIProps=%7B%22site%22%3A%22www.docusign.net%22%2C%20%22ti%22%3A%20%223a937140e8d84dec853cd1edc2bd46fd%22%20%7D</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://apps.docusign.com/favicon.ico?v=2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://apps.docusign.com/sign/app</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://apps.docusign.com/sign/app?ti=3a937140e8d84dec853cd1edc2bd46fd&amp;signing-config=%7B%22SigningAppDisabledFlags%22%3A%22%22%2C%22NotaryFetchSettings%22%3A%7B%22LiveoakTokenRequestTimeoutSeconds%22%3A30%2C%22EnableRemoteNotaryAuth%22%3Atrue%2C%22IsThirdPartyNotary%22%3Afalse%2C%22LiveoakTokenExchangeOrigin%22%3A%22%22%7D%2C%22WebFormsSettings%22%3Anull%2C%22OneDSMessagingOrigins%22%3Anull%2C%22FocusedViewSource%22%3Anull%7D&amp;site=www.docusign.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.optimizely.com/datafiles/8hG6JBWYXPkpW7PFWoe8H.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.optimizely.com/datafiles/MUGKFLCdCtxUSgrSTyhbw.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/olive/17.20.0/css/olive.min.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/olive/17.20.0/fonts/HelveticaNeueW01-55Roma.woff</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/olive/17.20.0/fonts/maven_pro_bold.woff</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/olive/17.20.0/img/mobile-web/mw-comments-24x24.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/olive/fonts/3.2.0/DSIndigo-Medium.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/olive/fonts/3.2.0/DSIndigo-Regular.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds-app/7168343/js/bundle.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/@ds/i18n-components/1.2.3/js/1ds-bundle.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/@ds/i18n/1.4.0/js/1ds-bundle.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/@ds/layouts/1.9.2/js/1ds-bundle.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/@ds/ui/8.8.0/dist/js/1ds-bundle.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/@emotion/react/11.14.0/dist/emotion-react.umd.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/@emotion/styled/11.14.0/dist/emotion-styled.umd.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/@fingerprintjs/fingerprintjs/4.6.2/dist/fp.umd.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/@optimizely/optimizely-sdk/5.4.1/dist/optimizely.browser.umd.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/@reduxjs/toolkit/1.9.1/dist/redux-toolkit.umd.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/import-map-overrides/5.1.1/dist/import-map-overrides-api.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/jquery/3.5.1/dist/jquery.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/lodash/4.18.1/lodash.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/lottie-web/5.11.0/build/player/lottie.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/moment-timezone/0.5.43/builds/moment-timezone-with-data.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/moment/2.29.4/min/moment-with-locales.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/react-dom/18.3.1/umd/react-dom.production.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/react/18.3.1/umd/react.production.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/systemjs/6.14.0/dist/extras/amd.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/libs/systemjs/6.14.0/dist/system.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/imgs/transparentLoader.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/js/1ds-bundle.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/js/ai-bloom-iris-ambient-animation.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/js/ai-feature.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/js/comments-templates.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/js/document-search.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/js/freeform-palette.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/js/guided-forms.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/js/olive.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/js/otel-context.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/js/rocket-copilot-reveal-panel.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/js/src_js_reactApp_components_AI_index_ts.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/js/styles.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/js/telemetry-backend.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/js/vendors-node_modules_ds_icons_lib_esm_inkSystem_ArrowUp_js-node_modules_ds_icons_lib_esm_inkS-1497ef.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/js/vendors-node_modules_ds_logging_dist_esm_TelemetryRecorder_telemetryRecorder_js.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/js/vendors-node_modules_ds_ui_lib_esm_components_CheckboxGroup_CheckboxGroup_js-node_modules_ds_-8631e3.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/26.9.49-4/js/vendors-node_modules_ds_ui_lib_esm_components_Table_Table_js.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@shared/ai-assisted-callout/1.0.76/js/1ds-bundle.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/production/1ds/widgets/@sign/plugin/1.0.442/js/1ds-bundle.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telemetry.docusign.net/api/v1/TelemetryWrapper</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.docusign.com/legal/terms-and-conditions</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.docusign.com/privacy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.docusign.net/Signing/EmailStart.aspx?a=924b70b3-9474-8658-828f-c52a065dee83&amp;etti=33&amp;acct=70c45010-f93a-48ea-b24e-58d0e655f8ad&amp;er=1e79abd0-adc2-88f9-8252-1e97ef39c8ee__;!!AaG5Gbqq9twG!V6APYdMzFhUmZsqk_KjlXFHoZE7FkhETeJWzQBS9JRDzXuKBy76U4VNPuMzAHfHjKtAVK5gmzayGlLB-J2YrSzmWEQwjjYD9ciMv6KY$&amp;AspxAutoDetectCookieSupport=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:docusign-hr@teachersfcu.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.docusign.net</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/olive/images/2.63.0/global-assets/ds-icons-favicon-dark-16x16.png</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/olive/images/2.63.0/global-assets/ds-icons-favicon-dark-24x24.png</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/olive/images/2.63.0/global-assets/ds-icons-favicon-dark-64x64.png</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/olive/images/2.63.0/global-assets/ds-icons-favicon-default-16x16.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/olive/images/2.63.0/global-assets/ds-icons-favicon-default-24x24.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://docucdn-a.akamaihd.net/olive/images/2.63.0/global-assets/ds-icons-favicon-default-64x64.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.docusign.net/Signing/EmailStart.aspx?a=924b70b3-9474-8658-828f-c52a065dee83&amp;etti=33&amp;acct=70c45010-f93a-48ea-b24e-58d0e655f8ad&amp;er=1e79abd0-adc2-88f9-8252-1e97ef39c8ee__;!!AaG5Gbqq9twG!V6APYdMzFhUmZsqk_KjlXFHoZE7FkhETeJWzQBS9JRDzXuKBy76U4VNPuMzAHfHjKtAVK5gmzayGlLB-J2YrSzmWEQwjjYD9ciMv6KY$</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>docucdn-a.akamaihd.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>a.docusign.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>apps.docusign.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>cdn.optimizely.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>docucdn-a.akamaihd.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>telemetry.docusign.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.docusign.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.docusign.net</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.18.66.57</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>2.16.164.81</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>2.16.164.9</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>20.4.162.53</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>20.7.90.58</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>23.216.77.132</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>23.216.77.174</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>23.45.100.24</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>52.35.137.158</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>23.216.77.132</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>e11827c678af8519e702f364e525ac34509cad49f8d839677e089949edda060e</SHA-256>
              <SHA-1>961b2ee6fb39c4d515bdc49ec1ba688b0916f104</SHA-1>
              <MD5>afe00db89ce086b91a541c227edbf136</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>3b8bd40d1f9311c4dda01e633e4d6b162145f088bf72e74367b8ea117ca15bf0</SHA-256>
              <SHA-1>fad9f40908c05286197680b2e8b4e20e05ee3b9f</SHA-1>
              <MD5>164a399138baf143d8371cfd488e6761</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>3d41bda6bbdb76a117b7b6f0c41cdaea79f96140af54b2b8bdf0024d8e8b850e</SHA-256>
              <SHA-1>db12aa38a7e7d7c2e0153e9a2d08a2d38732e456</SHA-1>
              <MD5>c2607f54138adaa863040c7aaf919ed8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://www.docusign.net/Signing/EmailStart.aspx?a=924b70b3-9474-8658-828f-c52a065dee83&amp;etti=33&amp;acct=70c45010-f93a-48ea-b24e-58d0e655f8ad&amp;er=1e79abd0-adc2-88f9-8252-1e97ef39c8ee__;!!AaG5Gbqq9twG!V6APYdMzFhUmZsqk_KjlXFHoZE7FkhETeJWzQBS9JRDzXuKBy76U4VNPuMzAHfHjKtAVK5gmzayGlLB-J2YrSzmWEQwjjYD9ciMv6KY$</name>
        <report_id>48244097-279b-463c-9deb-29ff02d82f61</report_id>
        <tags>
          <value>html</value>
          <value>png</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8ea02581ca27f51d6436e87a114c874ae59503961352f505092ca256ac58a205</id>
    <title>Analysis Report for 8ea02581ca27f51d6436e87a114c874ae59503961352f505092ca256ac58a205</title>
    <updated>2026-10-05T12:43:14Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39b8ad130e7ad452678df</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac39b60b242df12a78e12ea</flow_id>
        <hash>8ea02581ca27f51d6436e87a114c874ae59503961352f505092ca256ac58a205</hash>
        <iocs>
          <urls>
            <value>
              <url>http://api.jejuslotvip.mom:8080</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://backdoor.jejuslotvip.mom:8080</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://c2.jejuslotvip.mom:8080</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://jejuslotvip.mom:80</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://jejuslotvip.mom:8080</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://malware.jejuslotvip.mom:8080</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.jejuslotvip.mom:8080</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://pro.ip-api.com/line/?key=QPVvv1rHQJD2pd2&amp;fields=25948155</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>pro.ip-api.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>api.jejuslotvip.mom</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>backdoor.jejuslotvip.mom</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>c2.jejuslotvip.mom</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>jejuslotvip.mom</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>malware.jejuslotvip.mom</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.jejuslotvip.mom</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>188.114.96.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>51.77.64.70</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>188.114.97.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>12b3cf109f2818be4874ec08d906cd6c25b76a1ded8b026045e45f5ca690de91</SHA-256>
              <SHA-1>1a30c0c0feba1b9ef5e808be8cde57f395e577cb</SHA-1>
              <MD5>3bab1ff36e4049db3035358ecf00dc5b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>251d1a64ad11c82e4af4521a5e3ae23aae468ac848da8a66eb63fd8cd056ffc4</SHA-256>
              <SHA-1>70149c8ca25a3acaf3fba794a09f68e8c5b27c16</SHA-1>
              <MD5>780b0247f1fd66812cac8be31ea76ce5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>3661c7bdf3dfbd1f349aaa80a2793d28eba5a94325cc4ad3bcee2682dff9681d</SHA-256>
              <SHA-1>8af8e6fba12027aa32a43564a46f78bc6553c3d7</SHA-1>
              <MD5>44af1d49552a06fd5a3355a002a814b8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>5655775933efda1e38ae00f0b8f85f60955669ef9bec207ebb979ecc2cecbea4</SHA-256>
              <SHA-1>0b4a680a9ff94d0fff9a538af1bece92dec547d7</SHA-1>
              <MD5>66f67de06f53b387de72d7419b257dd4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>5dd7bade4b5e9a2ddaa8dac9a1288d26c5f61c2aaa1abc1fbbbd7b970494855f</SHA-256>
              <SHA-1>2b6c852e7a922d4000b3fddaa4ee82a4218a0b2e</SHA-1>
              <MD5>65081b1d17440ed59e9e8054927a0912</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>795473e7abf0e7e7dfd7cc5edcb0fd8cff9b145a5f28f76495ddb8a99ee03ce5</SHA-256>
              <SHA-1>9d86d14aeefa55c4ca5893739374b0f7e2c8f9b0</SHA-1>
              <MD5>b23fb58bf9141f6fa37584c3d608e960</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>ad4a5aad6219f3a1fce97f7b45e787ca6947e9af37c4ee39698934208aeffa45</SHA-256>
              <SHA-1>c4d90dd338b5979f1a2169d51e745fe40c46c082</SHA-1>
              <MD5>1867677010a8b98518bbad5053c9f3fb</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>d8e086b038111b0d2ec2a284aa7464147507bbe42bf20905205482bb6b448fb4</SHA-256>
              <SHA-1>55a76be098ab76c0f3e2134e7ce7fdaea318fc46</SHA-1>
              <MD5>6eec42acd08bf787da39b691471b6254</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>eb843187cd0be9f5d0c084c1c94f1394460509fa6a98a5298cd1d479dba5c7fe</SHA-256>
              <SHA-1>c08e96b331abb657aa4b862a92d8e62cd20ccd37</SHA-1>
              <MD5>0d8d3506302f7a0d12e5ff8215b60e69</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>fac255e0c4da8ba3bc95bc3aedc7f05dfb5f9a6479b97f7e8ecb70683e804bba</SHA-256>
              <SHA-1>b573893fe008997b651783e4efc21c7b17c523d4</SHA-1>
              <MD5>9f237083d977fcf7d969d9edfbb47c34</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>b60adc6967eaff727d3fecf8ec0ff8675f2f312e417ec0c530a9aa8f90d23c9c</SHA-256>
              <SHA-1>3ebde9623d9ab16c168ee51a5d4cbd636d3ef26c</SHA-1>
              <MD5>df355e6cf4cc7a1bea395016f2f74070</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>f97e9aa91b165f3cde118cda63bff995ce3bf54fb74ad5e8550e6b1b6731979a</SHA-256>
              <SHA-1>909ed1241b45c4c338b15f200be3e72bd699cf47</SHA-1>
              <MD5>c5caa2790fc0caa36690198510bd9c7b</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>7e12926509017c80723e32a19293f72bb0621b9b34bb9c70a23c5f87ed63c886</SHA-256>
              <SHA-1>de4aa69548a154a2d9eea3317684767722a71fcc</SHA-1>
              <MD5>781a8964d94e29499f84c47db50087bb</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>b8c4a0fa2e0419ab22c2d7b023363d4fbd6de87a25f8f86c6fcc4620343ae651</SHA-256>
              <SHA-1>03d91b267e7981892c8c9d471a10736116cc1c22</SHA-1>
              <MD5>20d1ca833d2abfc6ec33e41bd461b3cc</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>fff842d8adb74c961d08ab38748e9ae3c2e90b60273c8fc37926fc190942bf47</SHA-256>
              <SHA-1>b604d5feb5143e0b78d9a2575176bdd231beb81c</SHA-1>
              <MD5>fe239c506186ca563bd4ebf66f2f682c</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>a6d61e9f70a51f946f57b1003e83c841b5d605243072345a97bcc8845fcee6ab</SHA-256>
              <SHA-1>54a8dfc0cbb5d33988b830052344d227d5a5472a</SHA-1>
              <MD5>7beadc1b8bc4650f1aa7607141ad0bb5</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>9517740692036139a4ca10a504a4c1beb6cfb08a386e7a354c444488cef28c2d</SHA-256>
              <SHA-1>3fa1d16c5abd243b35f8679dbf584771fb78f5df</SHA-1>
              <MD5>3b1802dfb57e33ce9ed40b531ab5c66a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>b4fbeac69713d89c98d9e80712f39e230bb21e16bc4ac1801a7b6aadc7b7979e</SHA-256>
              <SHA-1>58a5c57b5b012deef67d37eb734b7375f5b2866a</SHA-1>
              <MD5>9343f04b15161fa79518af80407ac458</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>3E5FC7F9-9A51-4367-9063-A120244FBEC7</uuid>
              <origin>INPUT_FILE</origin>
              <verdict>LIKELY_MALICIOUS</verdict>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>SOFTWARE\Microsoft\Windows NT\CurrentVersion</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Run\</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Uninstall</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>UU88 APP.exe</name>
        <report_id>e24c863e-727b-4367-9bcf-3947abcdeb83</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>txt</value>
          <value>remcos</value>
          <value>config-extracted</value>
          <value>backdoor</value>
          <value>evasive</value>
          <value>rat</value>
          <value>exploit</value>
          <value>keylogger</value>
          <value>remoteaccesstool</value>
          <value>anti-debug</value>
          <value>explorer</value>
          <value>lolbin</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>packed</value>
          <value>microsoft_visual_cc</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ed1d368fb8389fa6fbee58f9e98a48c20547f4409711e8960d5e6f4b560d8cab</id>
    <title>Analysis Report for ed1d368fb8389fa6fbee58f9e98a48c20547f4409711e8960d5e6f4b560d8cab</title>
    <updated>2026-10-05T12:42:50Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39b87d130e7ad452678de</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac39b48b242df12a78e128c</flow_id>
        <hash>ed1d368fb8389fa6fbee58f9e98a48c20547f4409711e8960d5e6f4b560d8cab</hash>
        <iocs>
          <urls>
            <value>
              <url>http://yvonnebijenhof.nl:6606</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>yvonnebijenhof.nl</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>MALICIOUS</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>188.114.96.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>199cdbbdd8003a93f1901774ea9b55cfe05bc42c0de488cae3dec9033f5e2b8d</SHA-256>
              <SHA-1>74cf6c5a8b5929d7fafa30d6cdfd70a22ca2a622</SHA-1>
              <MD5>8937388e409306592d6717ff26fb8902</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>24aed8cd9dd33430708708fbffc0d9db5e6c3564b2146768ae7a875cb1cfbc2e</SHA-256>
              <SHA-1>e3e08d1d929abf9a8d36e12c6ed22dabf796380b</SHA-1>
              <MD5>086edb5f6c36a34b4f6f6debe3ea4bb8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>48d525c2ba3677f2a6c5091ae1f49b5801b62b1410617476a43b0eb49f3b9fd1</SHA-256>
              <SHA-1>7fc91b484610e7bdaf42d98cc8ba682a62b1ebf3</SHA-1>
              <MD5>abafcec6badd861dae997034739df3e4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>4ff1c75a93b2280dabe75acecade82d644388c9f4412565d846aeb396bfdc133</SHA-256>
              <SHA-1>6a55e1445c1c915664fba385828c5a0078fe460d</SHA-1>
              <MD5>f3d7095de1636559aa56ad81b25bbff9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>6ad9d2a4ce0bfec38454a93a896d1bc0a20df9f884059a502ac0a51b0f7ade9b</SHA-256>
              <SHA-1>4c52b4caf7f31a63860ff3f648456739abbc15f2</SHA-1>
              <MD5>9d8bbe6ef2116ed1cf2f36b31cceff51</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>9a14ffe356eb7ff73b4da61f8402bde3823a877227d5ab68ac569bc68df84396</SHA-256>
              <SHA-1>961fa5d9c84f56615aa1c4b492aedfcc226e7438</SHA-1>
              <MD5>9f3b4acfbd96a9f79e34116b9617915a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>a1f04c0ff3f00624286a084aa5f8acfd4fc6fa81de5cb54f5a1cbaff2f865320</SHA-256>
              <SHA-1>b91e7605d5ffb4ce68fc7582bf38f951889a9228</SHA-1>
              <MD5>de9434b651affc51661d88045d31eeac</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>ac35ad07fd04afd83957afbb93fd07a3b28845b44868d360bc44c3691d2e2a17</SHA-256>
              <SHA-1>7d6ab23ab1ad400caa6101717d672e7f765df239</SHA-1>
              <MD5>1100a17a9eb2346496cb8cf2ecf8704b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>d92e9af9c6c038f4da559e0ac30efc0427fa6915bf19efbd1fa05e5f2d8053ec</SHA-256>
              <SHA-1>1ebe62b065bfa230e0041ae850694c99e413f0e3</SHA-1>
              <MD5>f573e81dc7154adc71a17e8f9db3f3d0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>ddede0123042d7c2cb04fef5b97681305b96cb82090bd1542c34f65bd6fa958a</SHA-256>
              <SHA-1>cb65124f82054a26c36479436ef2eccce16d9236</SHA-1>
              <MD5>0e1fa9c5c3ffa6af1f61acdd1f6646f2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>eae9a65b090d08f80a28849db1265ff641cb2bfcbdaf1e83be0547c44ad5b1f3</SHA-256>
              <SHA-1>24720384c767e9084cd55a12cb6bd39f072ce9bd</SHA-1>
              <MD5>cf1a3fb00947dc25a5262b066f06e422</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>fa33db1a55a9917cb6e055330f51f8a3417fef815774fa5f45f7c288b4d9fe1c</SHA-256>
              <SHA-1>d1443fcbbf878b01303a6ccf228895a69d52fea5</SHA-1>
              <MD5>5f9cfdb51f1b6f9f34cd22ae002865f6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\</registry>
              <origin>DOTNET_DECOMPILATION</origin>
            </value>
          </registry>
        </iocs>
        <name>yvonnebijenhof.nl.exe</name>
        <report_id>a5097b7b-71f2-4706-9c15-5031e630d124</report_id>
        <tags>
          <value>peexe</value>
          <value>dotnet_pe</value>
          <value>asyncrat</value>
          <value>config-extracted</value>
          <value>remoteaccesstool</value>
          <value>anti-vm</value>
          <value>fingerprint</value>
          <value>base64</value>
          <value>reconnaissance</value>
          <value>lolbin</value>
          <value>schtasks</value>
          <value>obfuscated</value>
          <value>vbnet</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d27546bbb443eab35d98d1a37b26f2370a4837a71f85db31c3cc6d52c9f422ff</id>
    <title>Analysis Report for d27546bbb443eab35d98d1a37b26f2370a4837a71f85db31c3cc6d52c9f422ff</title>
    <updated>2026-10-05T12:42:38Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39b65d130e7ad452678d4</_id>
        <file_type>application/vnd.android.package-archive</file_type>
        <flow_id>6ac39b3c31f292eab9b50cb1</flow_id>
        <hash>d27546bbb443eab35d98d1a37b26f2370a4837a71f85db31c3cc6d52c9f422ff</hash>
        <iocs>
          <urls>
            <value>
              <url>http://dashboard.data/debug</url>
              <origin>APK_DECODING</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://android.googlesource.com/toolchain/llvm-project</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>dashboard.data</url>
              <origin>APK_DECODING</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>android.googlesource.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>127.0.0.1</ip>
              <origin>APK_DECODING</origin>
            </value>
            <value>
              <ip>142.251.127.82</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>b4336628568d4f3bbb378074a847eb62110330593fbe9e5c39902b40b21433d2</SHA-256>
              <SHA-1>b7c43f260aec0b711010849d637b3bbebdb45c1f</SHA-1>
              <MD5>25250b7f88591f1b761de54f09eb405f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>app.apk</name>
        <report_id>8eecf878-72f4-4743-a1a7-f1a56b340817</report_id>
        <tags>
          <value>apk</value>
          <value>html</value>
          <value>crypto</value>
          <value>evasive</value>
          <value>fingerprint</value>
          <value>signed</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>6ad10d228d3b5a3a9b96af1028d8e7b2f11a2d176a73a12bed823b63a073a1e8</id>
    <title>Analysis Report for 6ad10d228d3b5a3a9b96af1028d8e7b2f11a2d176a73a12bed823b63a073a1e8</title>
    <updated>2026-10-05T12:41:01Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39af3d130e7ad452678ba</_id>
        <file_type>application/xhtml+xml</file_type>
        <flow_id>6ac39adc766af099f2b3b9c2</flow_id>
        <hash>6ad10d228d3b5a3a9b96af1028d8e7b2f11a2d176a73a12bed823b63a073a1e8</hash>
        <iocs>
          <urls>
            <value>
              <url>file:///tmp/tmpgx8z3u6r.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:moked@mail.gov.il</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <emails>
            <value>
              <email>moked@mail.gov.il</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
        </iocs>
        <name>9969886_3d20d5b3-b74b-4507-88b3-08ab3ad48025@9969886</name>
        <report_id>2162439b-47db-4e8c-b935-0ec67f77cc8f</report_id>
        <tags>
          <value>html</value>
          <value>xml</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>5d5bc8fc0898d8da5fbf0d7cb64f2cc3519c15933ec796396bb2114135c40aed</id>
    <title>Analysis Report for 5d5bc8fc0898d8da5fbf0d7cb64f2cc3519c15933ec796396bb2114135c40aed</title>
    <updated>2026-10-05T12:40:01Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39ab2d130e7ad452678af</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39aa082af77f74b7f5411</flow_id>
        <hash>5d5bc8fc0898d8da5fbf0d7cb64f2cc3519c15933ec796396bb2114135c40aed</hash>
        <iocs>
          <urls>
            <value>
              <url>https://click.e.atlassian.com/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://click.e.atlassian.com/redirect_error.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://click.e.atlassian.com/?qs=ABB7InYiOjEsImQiOjUwMTV9AAEAAAAAAhIQ0TCmsxpSktyenFW0Uq3MpE68wBCvvWcvbnbOrDeCS2ntR8zdqLt1f-wgqT7GmkRNRB359L5PDgL6ar-zeuyRETdRr1YsTJjA9Up1QTk__;!!AaG5Gbqq9twG!WjSXlUnSrhm2gprPII2IXGbWF9JrcQWgd0rosyMFjdqcNi5rGv80beFrtXHz2BIvCULeU-PxNbBNqxtEOx-bw92f25eKEitNoEKvjP0$</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>click.e.atlassian.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>13.111.134.82</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxps://click.e.atlassian.com/?qs=ABB7InYiOjEsImQiOjUwMTV9AAEAAAAAAhIQ0TCmsxpSktyenFW0Uq3MpE68wBCvvWcvbnbOrDeCS2ntR8zdqLt1f-wgqT7GmkRNRB359L5PDgL6ar-zeuyRETdRr1YsTJjA9Up1QTk__;!!AaG5Gbqq9twG!WjSXlUnSrhm2gprPII2IXGbWF9JrcQWgd0rosyMFjdqcNi5rGv80beFrtXHz2BIvCULeU-PxNbBNqxtEOx-bw92f25eKEitNoEKvjP0$</name>
        <report_id>6c402088-8f70-41eb-9499-cf4e73e01259</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T12:34:24Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3995d89017dd18dc1c1f3</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac3994f766af099f2b3b830</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>c2e79576-386b-4bbc-af52-7c5acbfd3ea9</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>af477c750560352a953117f2a9c1ef66da016e296ad0772fbaedd754d3559f27</id>
    <title>Analysis Report for af477c750560352a953117f2a9c1ef66da016e296ad0772fbaedd754d3559f27</title>
    <updated>2026-10-05T12:34:23Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac399b5d130e7ad45267881</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac3994d31f292eab9b506f0</flow_id>
        <hash>af477c750560352a953117f2a9c1ef66da016e296ad0772fbaedd754d3559f27</hash>
        <iocs>
          <urls>
            <value>
              <url>http://wmwindiana.org:6606</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>wmwindiana.org</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>188.114.96.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>199cdbbdd8003a93f1901774ea9b55cfe05bc42c0de488cae3dec9033f5e2b8d</SHA-256>
              <SHA-1>74cf6c5a8b5929d7fafa30d6cdfd70a22ca2a622</SHA-1>
              <MD5>8937388e409306592d6717ff26fb8902</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>24aed8cd9dd33430708708fbffc0d9db5e6c3564b2146768ae7a875cb1cfbc2e</SHA-256>
              <SHA-1>e3e08d1d929abf9a8d36e12c6ed22dabf796380b</SHA-1>
              <MD5>086edb5f6c36a34b4f6f6debe3ea4bb8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>48d525c2ba3677f2a6c5091ae1f49b5801b62b1410617476a43b0eb49f3b9fd1</SHA-256>
              <SHA-1>7fc91b484610e7bdaf42d98cc8ba682a62b1ebf3</SHA-1>
              <MD5>abafcec6badd861dae997034739df3e4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>4ff1c75a93b2280dabe75acecade82d644388c9f4412565d846aeb396bfdc133</SHA-256>
              <SHA-1>6a55e1445c1c915664fba385828c5a0078fe460d</SHA-1>
              <MD5>f3d7095de1636559aa56ad81b25bbff9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>6ad9d2a4ce0bfec38454a93a896d1bc0a20df9f884059a502ac0a51b0f7ade9b</SHA-256>
              <SHA-1>4c52b4caf7f31a63860ff3f648456739abbc15f2</SHA-1>
              <MD5>9d8bbe6ef2116ed1cf2f36b31cceff51</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>9a14ffe356eb7ff73b4da61f8402bde3823a877227d5ab68ac569bc68df84396</SHA-256>
              <SHA-1>961fa5d9c84f56615aa1c4b492aedfcc226e7438</SHA-1>
              <MD5>9f3b4acfbd96a9f79e34116b9617915a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>a1f04c0ff3f00624286a084aa5f8acfd4fc6fa81de5cb54f5a1cbaff2f865320</SHA-256>
              <SHA-1>b91e7605d5ffb4ce68fc7582bf38f951889a9228</SHA-1>
              <MD5>de9434b651affc51661d88045d31eeac</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>ac35ad07fd04afd83957afbb93fd07a3b28845b44868d360bc44c3691d2e2a17</SHA-256>
              <SHA-1>7d6ab23ab1ad400caa6101717d672e7f765df239</SHA-1>
              <MD5>1100a17a9eb2346496cb8cf2ecf8704b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>d92e9af9c6c038f4da559e0ac30efc0427fa6915bf19efbd1fa05e5f2d8053ec</SHA-256>
              <SHA-1>1ebe62b065bfa230e0041ae850694c99e413f0e3</SHA-1>
              <MD5>f573e81dc7154adc71a17e8f9db3f3d0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>ddede0123042d7c2cb04fef5b97681305b96cb82090bd1542c34f65bd6fa958a</SHA-256>
              <SHA-1>cb65124f82054a26c36479436ef2eccce16d9236</SHA-1>
              <MD5>0e1fa9c5c3ffa6af1f61acdd1f6646f2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>eae9a65b090d08f80a28849db1265ff641cb2bfcbdaf1e83be0547c44ad5b1f3</SHA-256>
              <SHA-1>24720384c767e9084cd55a12cb6bd39f072ce9bd</SHA-1>
              <MD5>cf1a3fb00947dc25a5262b066f06e422</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>fa33db1a55a9917cb6e055330f51f8a3417fef815774fa5f45f7c288b4d9fe1c</SHA-256>
              <SHA-1>d1443fcbbf878b01303a6ccf228895a69d52fea5</SHA-1>
              <MD5>5f9cfdb51f1b6f9f34cd22ae002865f6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\</registry>
              <origin>DOTNET_DECOMPILATION</origin>
            </value>
          </registry>
        </iocs>
        <name>wmwindiana.org.exe</name>
        <report_id>c9520543-d2bf-47fd-898d-15cdcb2c5e8c</report_id>
        <tags>
          <value>peexe</value>
          <value>dotnet_pe</value>
          <value>asyncrat</value>
          <value>config-extracted</value>
          <value>remoteaccesstool</value>
          <value>anti-vm</value>
          <value>fingerprint</value>
          <value>base64</value>
          <value>masquerade</value>
          <value>reconnaissance</value>
          <value>lolbin</value>
          <value>schtasks</value>
          <value>obfuscated</value>
          <value>vbnet</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T12:34:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3995cd130e7ad4526786f</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac3994931f292eab9b506e2</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>7b1a295f-69af-4b32-ba4d-376fde63e92d</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a68ffb2ba39e2ef6106cbc0185f7bce026e4223b3747e39277c8999f8543d6fd</id>
    <title>Analysis Report for a68ffb2ba39e2ef6106cbc0185f7bce026e4223b3747e39277c8999f8543d6fd</title>
    <updated>2026-10-05T12:34:14Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3994dd130e7ad4526786b</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac3994482af77f74b7f4e10</flow_id>
        <hash>a68ffb2ba39e2ef6106cbc0185f7bce026e4223b3747e39277c8999f8543d6fd</hash>
        <iocs>
          <urls>
            <value>
              <url>https://signal.menu</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
        </iocs>
        <name>hxxps://signal.menu</name>
        <report_id>e21504f5-0444-4b2d-970f-109eba47baec</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8f681557f5ca3141a8ca3af9dd624175973e95e1e34b89c51dde2c4c9ae8e74f</id>
    <title>Analysis Report for 8f681557f5ca3141a8ca3af9dd624175973e95e1e34b89c51dde2c4c9ae8e74f</title>
    <updated>2026-10-05T12:33:19Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39965d130e7ad45267871</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6ac3990c31f292eab9b50635</flow_id>
        <hash>8f681557f5ca3141a8ca3af9dd624175973e95e1e34b89c51dde2c4c9ae8e74f</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.opswat.com/solutions/email-security&amp;data=05</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>opswat.com</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>https://aka.ms/LearnAboutSenderIdentification</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.opswat.com%2Fsolutions%2Femail-security&amp;data=05%7C02%7Ctina.morettin%40opswat.com%7Ce0b71583edbe4e3275a008df209f9184%7C58122277edf8404896c4ec80d30669b8%7C0%7C0%7C639265541856392706%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C20000%7C%7C%7C&amp;sdata=zSRAqcJWUGgwNXqOvvO2QSQiq61tKUCEQ97nmur6Am8%3D&amp;reserved=0.</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://aka.ms/LearnAboutSenderIdentification</url>
              <origin>EMAIL_BODY</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.opswat.com%2Fsolutions%2Femail-security&amp;data=05%7C02%7Ctina.morettin%40opswat.com%7Ce0b71583edbe4e3275a008df209f9184%7C58122277edf8404896c4ec80d30669b8%7C0%7C0%7C639265541856392706%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C20000%7C%7C%7C&amp;sdata=zSRAqcJWUGgwNXqOvvO2QSQiq61tKUCEQ97nmur6Am8%3D&amp;reserved=0.</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.opswat.com/solutions/email-security&amp;data=05</url>
              <origin>EMAIL_BODY</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>opswat.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://aka.ms/LearnAboutSenderIdentification</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.opswat.com%2Fsolutions%2Femail-security&amp;data=05%7C02%7Ctina.morettin%40opswat.com%7Ce0b71583edbe4e3275a008df209f9184%7C58122277edf8404896c4ec80d30669b8%7C0%7C0%7C639265541856392706%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C20000%7C%7C%7C&amp;sdata=zSRAqcJWUGgwNXqOvvO2QSQiq61tKUCEQ97nmur6Am8%3D&amp;reserved=0.</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.opswat.com/solutions/email-security&amp;data=05</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>opswat.com</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>https://aka.ms/LearnAboutSenderIdentification</url>
              <origin>INPUT_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>file:///tmp/tmp_1phmji2.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aka.ms/LearnAboutSenderIdentification</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.opswat.com%2Fsolutions%2Femail-security&amp;data=05%7C02%7Ctina.morettin%40opswat.com%7Ce0b71583edbe4e3275a008df209f9184%7C58122277edf8404896c4ec80d30669b8%7C0%7C0%7C639265541856392706%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C20000%7C%7C%7C&amp;sdata=zSRAqcJWUGgwNXqOvvO2QSQiq61tKUCEQ97nmur6Am8%3D&amp;reserved=0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:tina.morettin%40opswat.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.opswat.com/solutions/email-security&amp;data=05</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>opswat.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>aka.ms</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>nam04.safelinks.protection.outlook.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>aka.ms</url>
              <origin>EMAIL_BODY</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>nam04.safelinks.protection.outlook.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>aka.ms</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>nam04.safelinks.protection.outlook.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>aka.ms</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>nam04.safelinks.protection.outlook.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>aka.ms</url>
              <origin>INPUT_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>elisehammond.k@connectlumen.digital</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>elisehammond.k@connectlumen.digital</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>01a0fd60-8a8d-7e1c-980f-4cc53830ca4a@connectlumen.digital</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>elisehammond.k@connectlumen.digital</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>tina.morettin@opswat.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>elisehammond.k@connectlumen.digital</email>
              <origin>CONTENT_PARSE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>2.23.246.9</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>52.102.113.45</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>10.1.24.53</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>10.167.244.39</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>255.255.255.255</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>54.69.214.246</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>fb2054be41fe2ccd891adfbf495b8f4dceccb36e94bf5e9a1f0f876d2e021ad4</SHA-256>
              <SHA-1>910e922f7280b49a224be7136ae4161a35245b9c</SHA-1>
              <MD5>9c657762c912100d6d8c18ddca963436</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/x-ini</file_type>
            </value>
            <value>
              <SHA-256>f809dae7b8ee0f4152d293c09c5d4d4fae874bf7bbca7424a015cdc6bfba8501</SHA-256>
              <SHA-1>e830828998a692a5f648f1300fe9fba4137cf62f</SHA-1>
              <MD5>5059b6f004750c4b8eaaeec05beded66</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>cb4b3a2d72a794eeb5a0e93fc139fa253b41c6b10e9bd12bea16c47951ba181d</SHA-256>
              <SHA-1>2d259167889f4001d2e314fb40bf2eeb8acbc4f0</SHA-1>
              <MD5>df4c73a17cff4a066d4b6bdd87fc98ac</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>0a4783979c55c54467d0617ab8a17389b5f08ff09f8f21a3500f34237f23156b</SHA-256>
              <SHA-1>526dd5d5c34adebdbef5b78001bff736748e41b3</SHA-1>
              <MD5>bf7ddc3a3bf34172fe2af39142c4c2e1</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>7c41b898c5da0cfa4aa049b65ef50248bce9a72d24bef4c723786431921b75aa</SHA-256>
              <SHA-1>10588307553e766ab3c7d328d948dc6754893cef</SHA-1>
              <MD5>825644f747baab2c00e420dbbc39e4b3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>98229587907787192b739026101c93146edc82ed3d7a5d0c4878b29f7e789ab6</SHA-256>
              <SHA-1>736d2cf47af1489f2fca121993fdd79f6f1e57e5</SHA-1>
              <MD5>e07e2fd77ad7b35963fef14f5057d26a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>01a0fd60-8a8d-7e1c-980f-4cc53830ca4a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>58122277-edf8-4048-96c4-ec80d30669b8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>90151951-6b7c-44ac-1b2f-08df209f8846</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>c207dfaf-2a25-4f29-77e5-08df209f8542</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e0b71583-edbe-4e32-75a0-08df209f9184</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>ZoomInfo renewal.eml</name>
        <report_id>24c5f317-5009-49a0-8a8e-e5c464f0f3af</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
          <value>html</value>
          <value>xml</value>
          <value>txt</value>
          <value>aidetect</value>
          <value>phishing</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>130228262d65eabc3dc7170a49e00fc56d4855e93a344b6c61d5e8d7c7f17886</id>
    <title>Analysis Report for 130228262d65eabc3dc7170a49e00fc56d4855e93a344b6c61d5e8d7c7f17886</title>
    <updated>2026-10-05T12:32:58Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39924d130e7ad45267863</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac398f882af77f74b7f4cd1</flow_id>
        <hash>130228262d65eabc3dc7170a49e00fc56d4855e93a344b6c61d5e8d7c7f17886</hash>
        <iocs>
          <urls>
            <value>
              <url>https://skil-care-customer-portal.netlify.app/?mc_cid=96e5017300&amp;mc_eid=UNIQID</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://cdn.shopify.com/s/files/1/1164/3390/files/SkilCareLogoUSA_SKAmerColor_bdeb57a9-b3a2-4ff5-8215-5f1ae3d76ab6.png?v=1779927640</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esm.sh/@supabase/auth-js@2.117.2/es2022/auth-js.mjs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esm.sh/@supabase/functions-js@2.117.2/es2022/functions-js.mjs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esm.sh/@supabase/phoenix@0.4.5/es2022/phoenix.mjs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esm.sh/@supabase/postgrest-js@2.117.2/es2022/postgrest-js.mjs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esm.sh/@supabase/realtime-js@2.117.2/es2022/realtime-js.mjs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esm.sh/@supabase/storage-js@2.117.2/es2022/storage-js.mjs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esm.sh/@supabase/supabase-js@2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esm.sh/@supabase/supabase-js@2.117.2/es2022/dist/tracingRegistry.mjs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esm.sh/@supabase/supabase-js@2.117.2/es2022/supabase-js.mjs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esm.sh/iceberg-js@%5E0.8.1?target=es2022</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esm.sh/iceberg-js@0.8.1/es2022/iceberg-js.mjs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esm.sh/node/async_hooks.mjs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esm.sh/node/buffer.mjs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esm.sh/node/events.mjs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esm.sh/node/process.mjs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esm.sh/node/tty.mjs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esm.sh/tslib@2.8.1/es2022/tslib.mjs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://heyzine.com/flip-book/d7dfc64051.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://skil-care-customer-portal.netlify.app/?mc_cid=96e5017300&amp;mc_eid=UNIQID</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://skil-care-customer-portal.netlify.app/portal-guide-poster.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.skil-care.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>cdn.shopify.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>esm.sh</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>heyzine.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>skil-care-customer-portal.netlify.app</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.skil-care.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>customerservice@skil-care.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>name@yourcompany.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>you@yourcompany.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>104.26.15.209</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>34.144.250.199</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>35.157.26.135</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
          <uuids>
            <value>
              <uuid>bdeb57a9-b3a2-4ff5-8215-5f1ae3d76ab6</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://skil-care-customer-portal.netlify.app/?mc_cid=96e5017300&amp;mc_eid=UNIQID</name>
        <report_id>a6d094df-eb74-4a54-9836-ded3af30b331</report_id>
        <tags>
          <value>html</value>
          <value>phishing</value>
          <value>base64</value>
          <value>aidetect</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>c7360ca44e2d1f412110d535ea4ce90a8f9f1bdb8121143526931efaf362d4cf</id>
    <title>Analysis Report for c7360ca44e2d1f412110d535ea4ce90a8f9f1bdb8121143526931efaf362d4cf</title>
    <updated>2026-10-05T12:32:34Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39919d130e7ad45267860</_id>
        <file_type>application/pdf</file_type>
        <flow_id>6ac398e282af77f74b7f4c86</flow_id>
        <hash>c7360ca44e2d1f412110d535ea4ce90a8f9f1bdb8121143526931efaf362d4cf</hash>
        <iocs>
          <urls>
            <value>
              <url>http://14782102.s21i.faiusr.com/61/2/ABUIABA9GAAgoLPmpwYouLX4ZA.pdf</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://down.holocloud.online/3DMagic_setup.exe</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://down.holocloud.online/3DMagic_setup.exe</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>down.holocloud.online</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>down.holocloud.online</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>47.107.225.132</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>3b74e1ef37c92a243c141c42058afc7f274d531432231f407c00c1a03004431f</SHA-256>
              <SHA-1>7d66ced260633d53a5e5ffd1f95afe196fc7ee61</SHA-1>
              <MD5>7dcd4bfd7397a7eaf146a9786a7546ed</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>547cdbadb6551d5d463c59485599e26fc131b11a5dfc8b28f6ecddafd51ac730</SHA-256>
              <SHA-1>db8c2e47db775be02b52bb7542f4aabac0ea1d95</SHA-1>
              <MD5>953331c578be7e00094a71b32552d15a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>c19f52bdb6f90ef656d35bbf1fdfb8664730d255618671814c3211aa6b77f05f</SHA-256>
              <SHA-1>18091009018f5f9f740bfc97731f6519e17bec49</SHA-1>
              <MD5>461cfb8e7795f495f7e31c1de5085037</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>c5628197abd06a45254724607885cb34fcf72d86c0cf2df89ec9a4cabf543612</SHA-256>
              <SHA-1>5c25387e8f8748bd54f60b375eebc5a2e1dcb6e8</SHA-1>
              <MD5>1cf335bc1b6a04a9470c58165787acb4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>c583167c9cd8fbc123990de5ba448ecf90bbad7260b0bedd68c86b7d3e83231c</SHA-256>
              <SHA-1>79d9e60acab1b581dec9036e1f39cb7a6f569c55</SHA-1>
              <MD5>497160884f79f8416058b17197ae57f1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>d9c19521b8ea54a0741853a248c0b3a49fcfd0ac858fd0b837a4584b02501889</SHA-256>
              <SHA-1>3eea979c3c0543a6ec641b7e782f7d054c3ec7c6</SHA-1>
              <MD5>a597f9a56275bb4ccd6584d02d4db6ff</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>e4c86ba49446c8c87b6d099b4523f19c6c18545809b5c22013facb8880eeeb4b</SHA-256>
              <SHA-1>4fcb2479aaf099eda67d6046bf0810ebd7777d4c</SHA-1>
              <MD5>993af181107a584f53756a573b505bcf</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>b89a6bf2d14a7feb9644a40bc03d562fccced18c837a549b52eddfd06f198caf</SHA-256>
              <SHA-1>d3db10ef545f1626ab227b7225334b234a40c057</SHA-1>
              <MD5>4447bb239560140ec10387ea1ccc92b5</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
              <verdict>LIKELY_MALICIOUS</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>59e95b75-afdc-4b47-8cbf-649e335d15e2</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>b4dbed67-26a4-45a2-8d81-71f35b3be7f1</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxp://14782102.s21i.faiusr.com/61/2/ABUIABA9GAAgoLPmpwYouLX4ZA.pdf</name>
        <report_id>3ce827b7-7f95-49db-a70e-2f45a511e025</report_id>
        <tags>
          <value>pdf</value>
          <value>peexe</value>
          <value>anti-debug</value>
          <value>reconnaissance</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>182ea284f66ed3aa934d7c236d1e0e8cbc9befdc6cd8baf34652c67a6e65b141</id>
    <title>Analysis Report for 182ea284f66ed3aa934d7c236d1e0e8cbc9befdc6cd8baf34652c67a6e65b141</title>
    <updated>2026-10-05T12:32:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac398f5d130e7ad45267858</_id>
        <file_type>application/vnd.android.package-archive</file_type>
        <flow_id>6ac398db31f292eab9b50592</flow_id>
        <hash>182ea284f66ed3aa934d7c236d1e0e8cbc9befdc6cd8baf34652c67a6e65b141</hash>
        <iocs>
          <emails>
            <value>
              <email>android@android.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>android@android.com0</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>127.0.0.1</ip>
              <origin>APK_DECODING</origin>
            </value>
          </ips>
        </iocs>
        <name>Cheat%20Standoff2%201.0.0.apk</name>
        <report_id>215b51d1-41f2-4e17-8b78-dd1dfa1867f9</report_id>
        <tags>
          <value>apk</value>
          <value>signed</value>
          <value>base64</value>
          <value>crypto</value>
          <value>evasive</value>
          <value>fingerprint</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>154bd322ff9523c0fe7c4a49211dbf969422ebf09115750d1e4be63c1b79afb5</id>
    <title>Analysis Report for 154bd322ff9523c0fe7c4a49211dbf969422ebf09115750d1e4be63c1b79afb5</title>
    <updated>2026-10-05T12:31:34Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac398f2d130e7ad45267855</_id>
        <file_type>application/xhtml+xml</file_type>
        <flow_id>6ac398a531f292eab9b504ef</flow_id>
        <hash>154bd322ff9523c0fe7c4a49211dbf969422ebf09115750d1e4be63c1b79afb5</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cdn.smava.de/fonts/roboto.css</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.smava.de/mediabuy=</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.smava.de/mediabuying/Kamp=</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.smava.de/mediabuying/Kampagne/=</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.smava.de/mediabuying/Kampagne/zK388/head=</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.smava.de/mediabuying/Legaltexte/30K_neu.pn=</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://click.antrag.smava.de/cp?mid=3D01m0hsj6z4nen1v3a5d025y=</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=3DRoboto:400,400i,7=</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://mailings.bestrelationsdigital.de</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://mailings.bestrelationsdigital.de/rl_9108558953.php?20228-453666-9299883-9110108-9108558953-8-1&amp;ocu=true</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://mailings.bestrelationsdigital.de/rl_9108558953.php?20228-=</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://mailings.bestrelationsdigital.de/trk?95m9FPp3c=</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://mailings.bestrelationsdigital.de/trk?95m9FPp3ce=</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://www.best-relations-digital.de/impressum</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.smava.de/em=</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>file:///tmp/tmpo4geo8zb.html</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>best-relations-digital.de</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>cdn.smava.de</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>click.antrag.smava.de</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>mailings.bestrelationsdigital.de</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>smava.de</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>192.178.183.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>136.243.167.155</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.222.35.85</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>212.227.15.138</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>52.222.236.45</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>159.69.221.149</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>116.203.118.191</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>18.172.112.61</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>9223cecbf8a8f7157ac487d79fc9914dd6f583eb8cdef24923c68c8747a74ff8</SHA-256>
              <SHA-1>7150f8a9551594393ed2bb79c86ff705e60a7651</SHA-1>
              <MD5>cdee567f54b41ff57f40b82ecdcc662c</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/css</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>a824bc7739e226e1b40ea0f8c4e4f4c6f796fc3b4abfa6e9abe3bd119a30d938</SHA-256>
              <SHA-1>0dde8fd9111d807e202b2fb37f8bcc4052fd861e</SHA-1>
              <MD5>b6c792c0f58fa3ec92173c074885221f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>327a37a08e906aabb8185dda6a15a62936da1006473d3a769c728194386375b2</SHA-256>
              <SHA-1>45e370e03fa06b2e282c66448dda975a4cd28319</SHA-1>
              <MD5>41d629d728b1d9c27c6e1fe382113874</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>11e7a9d7772fbda7b8c1120517bf22f1414d23dc221c1ed3af7e98bc94b3797d</SHA-256>
              <SHA-1>d81b8878f6ab0223669eac22694e205e5e212115</SHA-1>
              <MD5>f399d4f221f35bd0397ef53e22872dd0</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>42354e368411cea1529499006addeb1852c3dbc148ad81a88d1b8dcbfa862b23</SHA-256>
              <SHA-1>9729cce4cdd56ea225a647d7d9b3098437a8075d</SHA-1>
              <MD5>185311291f0a6fbbab29d92c703222aa</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>submission.eml</name>
        <report_id>29e143cb-fe81-45f0-bd75-aec3975fc629</report_id>
        <tags>
          <value>html</value>
          <value>xml</value>
          <value>txt</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>675f3a21dc8913a31dc21cc2d8a20eb3310ee3219f3533eb14cf649a363dd268</id>
    <title>Analysis Report for 675f3a21dc8913a31dc21cc2d8a20eb3310ee3219f3533eb14cf649a363dd268</title>
    <updated>2026-10-05T12:31:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac398c4d130e7ad4526784d</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6ac3989231f292eab9b5049f</flow_id>
        <hash>675f3a21dc8913a31dc21cc2d8a20eb3310ee3219f3533eb14cf649a363dd268</hash>
        <iocs>
          <urls>
            <value>
              <url>http://104.168.4.206/bins.sh</url>
              <origin>INPUT_FILE</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>https://speed.cloudflare.com/__down?bytes=10000000'</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>speed.cloudflare.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.168.4.206</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.66.0.218</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>2aac39b80684f98d718804de17ad8c63d13ce4540bb99b12e95319dbe0d443dd</SHA-256>
              <SHA-1>7b182279a37a14d3346a055c30630c23c8d25394</SHA-1>
              <MD5>7d43c822510268387e59fcaa251a806f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>dissarm4.elf</name>
        <report_id>3eef7a05-3dc8-4e3e-a703-1ccc91e6a280</report_id>
        <tags>
          <value>elf</value>
          <value>txt</value>
          <value>expand</value>
          <value>lolbin</value>
          <value>gcc</value>
          <value>rust</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>219da73b74108d963ec479b8c4ae7bf2cfc0b7262c01eb7289897337b9dfbba8</id>
    <title>Analysis Report for 219da73b74108d963ec479b8c4ae7bf2cfc0b7262c01eb7289897337b9dfbba8</title>
    <updated>2026-10-05T12:28:54Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39819d130e7ad4526782b</_id>
        <file_type>application/vnd.ms-outlook</file_type>
        <flow_id>6ac39803edc8b0d17b003963</flow_id>
        <hash>219da73b74108d963ec479b8c4ae7bf2cfc0b7262c01eb7289897337b9dfbba8</hash>
        <iocs>
          <urls>
            <value>
              <url>http://www.gavkav-ev.com.it-index.eu/4af81104-eccf-46b6-a79d-b0505e6c47da</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.gavkav-ev.com.it-index.eu/gavkav-ev?id=973654b0-6c92-4a08-9547-ac605a180877</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.gavkav-ev.com.it-index.eu/4af81104-eccf-46b6-a79d-b0505e6c47da</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.gavkav-ev.com.it-index.eu/gavkav-ev?id=973654b0-6c92-4a08-9547-ac605a180877</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.gavkav-ev.com.it-index.eu/4af81104-eccf-46b6-a79d-b0505e6c47da</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.gavkav-ev.com.it-index.eu/gavkav-ev?id=973654b0-6c92-4a08-9547-ac605a180877</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.hornetsecurity.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.gavkav-ev.com.it-index.eu/4af81104-eccf-46b6-a79d-b0505e6c47da</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.gavkav-ev.com.it-index.eu/gavkav-ev?id=973654b0-6c92-4a08-9547-ac605a180877</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>gavkav-ev.com.it-index.eu</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>gavkav-ev.com.it-index.eu</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>hornetsecurity.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>gavkav-ev.com.it-index.eu</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>gavkav-ev.com.it-index.eu</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>1a730072e438-SAS@gavkav-ev.de.it-file.net</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>21622701F2F9B44AA46729DF33951CDA@eurprd01.prod.exchangelabs.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>INFO@GAVKAV-EV.DE.IT-FILE.NET</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>Michele.Barone@volkswagengroup.it</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>extern.matthias.colognese@volkswagengroup.it</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>info@gavkav-ev.de.it-file.net</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>mail.security@volkswagengroup.it__substg1.0_5D07001F</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>michele.barone@volkswagengroup.it</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>support@hornetsecurity.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>185.88.214.116</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>10.167.241.234</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>94.100.132.73</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>94.100.132.71</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>1abbf470cb6585907b6c0fffe83b0a626b44f496265db0933aa626283336f6ea</SHA-256>
              <SHA-1>b1a4d3064e86fde9b95153b12b04c86d927d365a</SHA-1>
              <MD5>2e38e95f5f7cbc391650ad2b3fc0cfa7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>5e89879184510e91e477d41c61bd86a0e9209e9ecc17909a7b0ee20427950cbc</SHA-256>
              <SHA-1>aa4c4dbdad7790c63c027f494c18bf1a1921dfbc</SHA-1>
              <MD5>c446646a95cd43c36d25583fdaea3dbc</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>f7a7e417918e24c2ec2331c07c13d0fbdd0ecf7ebf288bd9d581a5a2722b7e28</SHA-256>
              <SHA-1>3eef55cf8eb3200463e9172f9ff174a2b29e6ee0</SHA-1>
              <MD5>62eb4880c7cc769b97a8b12bcd965ced</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>d1f45c434a6f3159cf7426d2c53a322a130833d6fdb6899638dbcb4afe4efd8a</SHA-256>
              <SHA-1>6947e12e49cdb70bdfb3f2ba150df0ea08a8e2c4</SHA-1>
              <MD5>45dd04698f9cd2a5e73d0fae43a799e7</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>0f04b15ab03d6eb04c0000c7e1532e33efee154b4b5a506f49caefc6a72d6778</SHA-256>
              <SHA-1>bd5c7cd7ce0469d62acd031e54ffa5174faf350d</SHA-1>
              <MD5>5e0383f73a56e51f511bf5bf08b5dc45</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>fb2a02198ace8955cb3693e6114e34c5b230c565ca2906c244632ff6ce943e98</SHA-256>
              <SHA-1>d60fe98a96ee992726b9ab37696fe8e7b281245f</SHA-1>
              <MD5>48df93a6dfb089d8930dc8c8241a4498</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>3057b83458be81e01b9c73e2bc7d3691361aa90aa2ad37e336fa9919ac5d7185</SHA-256>
              <SHA-1>15f518d4530c985c1bc0027adede580dc107b988</SHA-1>
              <MD5>522693d225992f511e1cdd8dbb1301ba</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>4af81104-eccf-46b6-a79d-b0505e6c47da</uuid>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <uuid>973654b0-6c92-4a08-9547-ac605a180877</uuid>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <uuid>0f6f68be-4ef2-465a-986b-eb9a250d9789</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>191e7f72-a567-43dc-85c7-4eb7f4889fff</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>381cf52d-8528-4c00-a804-2e21871d4bb1</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4af81104-eccf-46b6-a79d-b0505e6c47da</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>5e706563-8689-441a-62f9-08df22da4f21</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>75e3b32e-bb7f-4b28-81a4-1a730072e438</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>775f0f8a-0837-4d25-a0ff-a5852bcbdcd6</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>973654b0-6c92-4a08-9547-ac605a180877</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4af81104-eccf-46b6-a79d-b0505e6c47da</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>973654b0-6c92-4a08-9547-ac605a180877</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>4af81104-eccf-46b6-a79d-b0505e6c47da</uuid>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <uuid>973654b0-6c92-4a08-9547-ac605a180877</uuid>
              <origin>CONTENT_PARSE</origin>
            </value>
          </uuids>
        </iocs>
        <name>EXT IMPORTANTE cambiamento nel certificato medico per linabilità al lavoro.msg</name>
        <report_id>0f6abcb0-cedd-452d-bf08-0035ad758125</report_id>
        <tags>
          <value>msg</value>
          <value>ole</value>
          <value>png</value>
          <value>html</value>
          <value>anti-vm</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>c7360ca44e2d1f412110d535ea4ce90a8f9f1bdb8121143526931efaf362d4cf</id>
    <title>Analysis Report for c7360ca44e2d1f412110d535ea4ce90a8f9f1bdb8121143526931efaf362d4cf</title>
    <updated>2026-10-05T12:28:39Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39816d130e7ad4526782a</_id>
        <file_type>application/pdf</file_type>
        <flow_id>6ac397f531f292eab9b502c1</flow_id>
        <hash>c7360ca44e2d1f412110d535ea4ce90a8f9f1bdb8121143526931efaf362d4cf</hash>
        <iocs>
          <urls>
            <value>
              <url>http://down.holocloud.online/3DMagic_setup.exe</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://14782102.s21i.faiusr.com/61/2/ABUIABA9GAAgoLPmpwYouLX4ZA.pdf</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://down.holocloud.online/3DMagic_setup.exe</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>down.holocloud.online</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>down.holocloud.online</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>47.107.225.132</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>3b74e1ef37c92a243c141c42058afc7f274d531432231f407c00c1a03004431f</SHA-256>
              <SHA-1>7d66ced260633d53a5e5ffd1f95afe196fc7ee61</SHA-1>
              <MD5>7dcd4bfd7397a7eaf146a9786a7546ed</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>547cdbadb6551d5d463c59485599e26fc131b11a5dfc8b28f6ecddafd51ac730</SHA-256>
              <SHA-1>db8c2e47db775be02b52bb7542f4aabac0ea1d95</SHA-1>
              <MD5>953331c578be7e00094a71b32552d15a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>c19f52bdb6f90ef656d35bbf1fdfb8664730d255618671814c3211aa6b77f05f</SHA-256>
              <SHA-1>18091009018f5f9f740bfc97731f6519e17bec49</SHA-1>
              <MD5>461cfb8e7795f495f7e31c1de5085037</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>c5628197abd06a45254724607885cb34fcf72d86c0cf2df89ec9a4cabf543612</SHA-256>
              <SHA-1>5c25387e8f8748bd54f60b375eebc5a2e1dcb6e8</SHA-1>
              <MD5>1cf335bc1b6a04a9470c58165787acb4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>c583167c9cd8fbc123990de5ba448ecf90bbad7260b0bedd68c86b7d3e83231c</SHA-256>
              <SHA-1>79d9e60acab1b581dec9036e1f39cb7a6f569c55</SHA-1>
              <MD5>497160884f79f8416058b17197ae57f1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>d9c19521b8ea54a0741853a248c0b3a49fcfd0ac858fd0b837a4584b02501889</SHA-256>
              <SHA-1>3eea979c3c0543a6ec641b7e782f7d054c3ec7c6</SHA-1>
              <MD5>a597f9a56275bb4ccd6584d02d4db6ff</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>e4c86ba49446c8c87b6d099b4523f19c6c18545809b5c22013facb8880eeeb4b</SHA-256>
              <SHA-1>4fcb2479aaf099eda67d6046bf0810ebd7777d4c</SHA-1>
              <MD5>993af181107a584f53756a573b505bcf</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>35a9c60b4829ce904cccb14616186cb26eb7bd23f80c6059ff0dfb52b59272bb</SHA-256>
              <SHA-1>c75456c934606e467d860cff5dd4e4636f0b8d93</SHA-1>
              <MD5>d108777f36cc120532e82e4952b6754b</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
              <verdict>LIKELY_MALICIOUS</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>59e95b75-afdc-4b47-8cbf-649e335d15e2</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>b4dbed67-26a4-45a2-8d81-71f35b3be7f1</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxp://14782102.s21i.faiusr.com/61/2/ABUIABA9GAAgoLPmpwYouLX4ZA.pdf</name>
        <report_id>22346a77-169f-4453-8e05-c36acfe85f68</report_id>
        <tags>
          <value>pdf</value>
          <value>peexe</value>
          <value>anti-debug</value>
          <value>reconnaissance</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>dd82dad8ce14a83c853a7c4553f6f44f9bed7bfd47950836fd7871c419b6fc8c</id>
    <title>Analysis Report for dd82dad8ce14a83c853a7c4553f6f44f9bed7bfd47950836fd7871c419b6fc8c</title>
    <updated>2026-10-05T12:26:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac397bfd130e7ad45267805</_id>
        <file_type>text/x-csrc</file_type>
        <flow_id>6ac3976631f292eab9b4fff0</flow_id>
        <hash>dd82dad8ce14a83c853a7c4553f6f44f9bed7bfd47950836fd7871c419b6fc8c</hash>
        <iocs/>
        <name>hello_win.c</name>
        <report_id>af58ab8e-a69f-412e-9afb-746909b7b30f</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>3e1d68de653673794bc6ab7df5215c8e73111f82691e320cfbdf382de7158301</id>
    <title>Analysis Report for 3e1d68de653673794bc6ab7df5215c8e73111f82691e320cfbdf382de7158301</title>
    <updated>2026-10-05T12:26:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac397cbd130e7ad4526780f</_id>
        <file_type>text/x-csrc</file_type>
        <flow_id>6ac3976631f292eab9b4fff0</flow_id>
        <hash>3e1d68de653673794bc6ab7df5215c8e73111f82691e320cfbdf382de7158301</hash>
        <iocs/>
        <name>hello_dll.c</name>
        <report_id>6de5171e-08d9-4d1f-8893-de4f4fa2ce12</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>11b86934bb2833f57fa0453a605ca342aee9207e193faea9b973baa2b2b4c35b</id>
    <title>Analysis Report for 11b86934bb2833f57fa0453a605ca342aee9207e193faea9b973baa2b2b4c35b</title>
    <updated>2026-10-05T12:26:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac397bad130e7ad45267800</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac3976631f292eab9b4fff0</flow_id>
        <hash>11b86934bb2833f57fa0453a605ca342aee9207e193faea9b973baa2b2b4c35b</hash>
        <iocs/>
        <name>updat.exe</name>
        <report_id>12bf834b-43e7-4b7c-b710-2d256231256b</report_id>
        <tags>
          <value>peexe</value>
          <value>reconnaissance</value>
          <value>mingw</value>
          <value>anti-debug</value>
          <value>evasive</value>
          <value>packed</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d8ec2d712ba9282bf7233a1cb8cb9b7166a3acf31076f9f4c3536f2841bf1038</id>
    <title>Analysis Report for d8ec2d712ba9282bf7233a1cb8cb9b7166a3acf31076f9f4c3536f2841bf1038</title>
    <updated>2026-10-05T12:26:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac397bdd130e7ad45267803</_id>
        <file_type>text/x-csrc</file_type>
        <flow_id>6ac3976631f292eab9b4fff0</flow_id>
        <hash>d8ec2d712ba9282bf7233a1cb8cb9b7166a3acf31076f9f4c3536f2841bf1038</hash>
        <iocs/>
        <name>libtcc_test.c</name>
        <report_id>bb87f1c1-203c-4248-abea-2f223844ee32</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>4cc3af8e2ccb0b213bcb1002d950fd2598843d09cbbe81b97adbc98bdf5525d7</id>
    <title>Analysis Report for 4cc3af8e2ccb0b213bcb1002d950fd2598843d09cbbe81b97adbc98bdf5525d7</title>
    <updated>2026-10-05T12:26:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac397c6d130e7ad45267808</_id>
        <file_type>text/x-csrc</file_type>
        <flow_id>6ac3976631f292eab9b4fff0</flow_id>
        <hash>4cc3af8e2ccb0b213bcb1002d950fd2598843d09cbbe81b97adbc98bdf5525d7</hash>
        <iocs/>
        <name>fib.c</name>
        <report_id>c6f270c8-4b0d-4fb0-b499-84ec74256c8b</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9987f002545ef3e8a6127a017684c1d3eca5da614c19732658e7bf75e42fdbf8</id>
    <title>Analysis Report for 9987f002545ef3e8a6127a017684c1d3eca5da614c19732658e7bf75e42fdbf8</title>
    <updated>2026-10-05T12:26:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac397c8d130e7ad4526780b</_id>
        <file_type>text/x-csrc</file_type>
        <flow_id>6ac3976631f292eab9b4fff0</flow_id>
        <hash>9987f002545ef3e8a6127a017684c1d3eca5da614c19732658e7bf75e42fdbf8</hash>
        <iocs/>
        <name>dll.c</name>
        <report_id>3fefce5f-6b74-4706-8dc2-26acf534714e</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>4a52570eeaf9d27722377865df312e295a7a23c3b6eb991944c2ecd707cc9906</id>
    <title>Analysis Report for 4a52570eeaf9d27722377865df312e295a7a23c3b6eb991944c2ecd707cc9906</title>
    <updated>2026-10-05T12:26:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac397add130e7ad452677fa</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac3976631f292eab9b4fff0</flow_id>
        <hash>4a52570eeaf9d27722377865df312e295a7a23c3b6eb991944c2ecd707cc9906</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>8c54fe2441c9b27fe738bb9cd6b553956d7bc176d16c9556e8d41914c5a105cf</SHA-256>
              <SHA-1>dbb7464b473bffe22b5da84f47b97b993722ce68</SHA-1>
              <MD5>2d72efa4d2cdf52f3844c35e87476dfb</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>e9238129bf1db3bfce3e2f31be53366ad63bac4a7b6bb256fe44c2f55653b661</SHA-256>
              <SHA-1>06aa2ae745e80867a2dd0ecd7a4ba3372bc06504</SHA-1>
              <MD5>fdfaa88705e9b574512eb467dbda7687</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
          </files>
        </iocs>
        <name>libtcc.dll</name>
        <report_id>0fce2ea6-6a80-4be0-a14b-4964edfc99a2</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>anti-debug</value>
          <value>evasive</value>
          <value>packed</value>
          <value>overlay</value>
          <value>mingw</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8086908965620ff6f1cd3bf27500953a5e61fc602ea453d2d3784fef14286665</id>
    <title>Analysis Report for 8086908965620ff6f1cd3bf27500953a5e61fc602ea453d2d3784fef14286665</title>
    <updated>2026-10-05T12:25:56Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3979ed130e7ad452677ee</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6ac39754766af099f2b3b570</flow_id>
        <hash>8086908965620ff6f1cd3bf27500953a5e61fc602ea453d2d3784fef14286665</hash>
        <iocs>
          <urls>
            <value>
              <url>http://upx.sf.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>upx.sf.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.18.20.237</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>f07678bd16df1e713cac0c04bd2eb0b3d2accfb98c589f6f63911d6f32ad1fa7</SHA-256>
              <SHA-1>ffe97378bfd32bb3d9919a016b38ede4aa2fcfdb</SHA-1>
              <MD5>20773388c0245f547b47d7b0a47b8850</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>upx-bin</name>
        <report_id>68f7ccb5-c5ad-4d35-902e-49c25e999123</report_id>
        <tags>
          <value>elf</value>
          <value>html</value>
          <value>packed</value>
          <value>upx</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>157021748a0be766d60201c27bf2d7f52c51c69a19f0be90b2e6c4bc82331388</id>
    <title>Analysis Report for 157021748a0be766d60201c27bf2d7f52c51c69a19f0be90b2e6c4bc82331388</title>
    <updated>2026-10-05T12:25:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3977cd130e7ad452677df</_id>
        <file_type>text/x-ruby</file_type>
        <flow_id>6ac39734766af099f2b3b532</flow_id>
        <hash>157021748a0be766d60201c27bf2d7f52c51c69a19f0be90b2e6c4bc82331388</hash>
        <iocs>
          <emails>
            <value>
              <email>m.rokos@sh.cvut.cz</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>m.rokos@sh.cvut.cz</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
        </iocs>
        <name>cipher.rb</name>
        <report_id>564ae0dc-dbd4-410e-8049-ad1a46f661c0</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>6f5bbfae960c39d79793d6b96fd35caa23b72d30a82c2f652f7da4adb5756b36</id>
    <title>Analysis Report for 6f5bbfae960c39d79793d6b96fd35caa23b72d30a82c2f652f7da4adb5756b36</title>
    <updated>2026-10-05T12:25:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39811d130e7ad45267827</_id>
        <file_type>text/x-ruby</file_type>
        <flow_id>6ac39734766af099f2b3b532</flow_id>
        <hash>6f5bbfae960c39d79793d6b96fd35caa23b72d30a82c2f652f7da4adb5756b36</hash>
        <iocs>
          <urls>
            <value>
              <url>http://www.openssl.org/support/faq.html</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.openssl.org/support/faq.html</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>openssl.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>openssl.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>gotoyuzo@notwork.org</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>gotoyuzo@notwork.org</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>34.49.79.89</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>f67792b9e2a62d27d4dbae56e0dfd7db700d982079ed95ced2aa332c78329dae</SHA-256>
              <SHA-1>726f43308850edb11cab729ad1c4a08d88aad5be</SHA-1>
              <MD5>487ac9c1cfa6e1dbde63b3b7d2f92636</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>buffering.rb</name>
        <report_id>0a5896d3-b287-4b49-bff4-823f86ddc188</report_id>
        <tags>
          <value>txt</value>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8951450b32e363e13b53400f0d8c60ba08538f0476499f4f426efec8d95cb958</id>
    <title>Analysis Report for 8951450b32e363e13b53400f0d8c60ba08538f0476499f4f426efec8d95cb958</title>
    <updated>2026-10-05T12:25:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39778d130e7ad452677db</_id>
        <file_type>text/xml</file_type>
        <flow_id>6ac39734766af099f2b3b532</flow_id>
        <hash>8951450b32e363e13b53400f0d8c60ba08538f0476499f4f426efec8d95cb958</hash>
        <iocs>
          <ips>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
        </iocs>
        <name>ruby_builtin_dlls.manifest</name>
        <report_id>0264c41f-f9ba-4a8c-a3f1-b4886125b224</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>611c56f191ec18cbbe57e66c9e136e87f9446f1980abc73cfe1e7489a3b4c1af</id>
    <title>Analysis Report for 611c56f191ec18cbbe57e66c9e136e87f9446f1980abc73cfe1e7489a3b4c1af</title>
    <updated>2026-10-05T12:25:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3977ad130e7ad452677dd</_id>
        <file_type>text/x-ruby</file_type>
        <flow_id>6ac39734766af099f2b3b532</flow_id>
        <hash>611c56f191ec18cbbe57e66c9e136e87f9446f1980abc73cfe1e7489a3b4c1af</hash>
        <iocs/>
        <name>version.rb</name>
        <report_id>8dc91384-2c1b-4edd-9ad4-bedfb66449bb</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>4ac3e37ba1134ac480a91f93b49ee3db5d3b96662256d0d2355489d533162f5a</id>
    <title>Analysis Report for 4ac3e37ba1134ac480a91f93b49ee3db5d3b96662256d0d2355489d533162f5a</title>
    <updated>2026-10-05T12:25:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac397f1d130e7ad4526781b</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac39734766af099f2b3b532</flow_id>
        <hash>4ac3e37ba1134ac480a91f93b49ee3db5d3b96662256d0d2355489d533162f5a</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schemas.microsoft.com/SMI/2016/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.ruby-lang.org/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.ruby-lang.org/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>ruby-lang.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>ruby-lang.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>185.199.108.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.107</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>203bd62c351108cf1ba15b1c67a77610af557be85d781c7c61ab88ff72bae6c3</SHA-256>
              <SHA-1>c7627b41b11429256e1cd60b8d4c2aff2f53da80</SHA-1>
              <MD5>36dae17942c15f1873398e23e1315f57</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>37637df3af5b1744db0ddaa8d1355b4a73702eef271e010244296259a232f81f</SHA-256>
              <SHA-1>9bf513cf58acc141e4d2d4e329679bf724692123</SHA-1>
              <MD5>96c75cc0a746df0eeaf21fde10bf03ac</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>3a42ec00d842909312978cc48b571b5d32b2f64def32d335222c1c16199b83ac</SHA-256>
              <SHA-1>0e0eedf89d1dd412e7833479b05cef37853a8d36</SHA-1>
              <MD5>4b3f67ead0b6938235b8c9f05d9b1a32</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>5c30e7dbe206abe728055059c2e486fdc7ab429576b724e5aec44093aa0c2907</SHA-256>
              <SHA-1>19ba9c753a6d1ab3205e2ea0560d170b9bb0bdb1</SHA-1>
              <MD5>41ca91ee2ba227160d79f39e181603b6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>77a1efb6136f52dd2372987b13bf486aa75baeacb93bad009aa3e284c57b8694</SHA-256>
              <SHA-1>99ce74251d19d800608e30bed6e0d793931da56e</SHA-1>
              <MD5>1ec6a7b3300970378c29695a6cc13d36</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>844ccb8c270f0cddfdf45f512c4e72f51b8fe6393c1895205d4399bed33f4d1f</SHA-256>
              <SHA-1>9e5a4f795bee348fc0ad6877403970e34dbd5e0a</SHA-1>
              <MD5>d4dc8ff6316e6a9cf9404ea438c5ac49</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>9ff60662eeceac8550010f5cb110ceb727f8760d2ea50626394bce691b90d64f</SHA-256>
              <SHA-1>4e92b9cf63110e6735641238bafdb26c6f4a0d16</SHA-1>
              <MD5>ce2896efc0baee81dda0e211d69de675</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>a0b9fd0477aba61c09e92986a826932207ead228b74621a5a0e1dc75b7642363</SHA-256>
              <SHA-1>a7813f1721b2bfa85c4e1e4c1402b2cb732131b3</SHA-1>
              <MD5>706719e42994225e5e303a2cd0153437</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>da4e697251db872a49a8e8156e43f2bb2d9e06739773070444711919a36cab79</SHA-256>
              <SHA-1>5ccd87f5a194b1f80881571f2df6c6f083ac81ee</SHA-1>
              <MD5>20d051980dcac0290117e043cfb19ca5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>f432f8424cbcda4d08a2f8b79c7af47a95aaa5b29834e1ed295d825df3fb0e78</SHA-256>
              <SHA-1>2a0d116bbc71529faf0e57db90533aa97889b584</SHA-1>
              <MD5>1a458c981d78e90b2ab1b6ca1c637160</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>Onedrive.exe</name>
        <report_id>dec794aa-fd90-4518-9c05-c27fdc0b363a</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>anti-vm</value>
          <value>crypto</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>fb34947b2c2be86d1c5f0b227157e07f9e0c4093eb9e1043a526dbab214ac425</id>
    <title>Analysis Report for fb34947b2c2be86d1c5f0b227157e07f9e0c4093eb9e1043a526dbab214ac425</title>
    <updated>2026-10-05T12:25:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac397bcd130e7ad45267801</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac39734766af099f2b3b532</flow_id>
        <hash>fb34947b2c2be86d1c5f0b227157e07f9e0c4093eb9e1043a526dbab214ac425</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>7ec6eb42f22ad9504273238a538b100f0f265a5ce8fcf1567e39509da7d491bf</SHA-256>
              <SHA-1>06ada15923b5cefb314ba5f13c3e0b317f02b530</SHA-1>
              <MD5>352b4bc64acb52a5b5a7d62a7906677c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>zlib1.dll</name>
        <report_id>decef082-bc50-4147-85ad-f5e00956c17b</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>anti-debug</value>
          <value>evasive</value>
          <value>packed</value>
          <value>overlay</value>
          <value>anti-vm</value>
          <value>crypto</value>
          <value>mingw</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>05b451d86d5d3f6d5340dff2807c99bf8640ac2a35b5f398f90a9c4ee2549f80</id>
    <title>Analysis Report for 05b451d86d5d3f6d5340dff2807c99bf8640ac2a35b5f398f90a9c4ee2549f80</title>
    <updated>2026-10-05T12:25:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac397cad130e7ad4526780d</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac39734766af099f2b3b532</flow_id>
        <hash>05b451d86d5d3f6d5340dff2807c99bf8640ac2a35b5f398f90a9c4ee2549f80</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>3cc81e3d324950955ba7797f1dc8a110cff24ae7224e2b0603a55b5dcc95f93b</SHA-256>
              <SHA-1>081853b9c386bdc49e38ed8b23779555eed0db93</SHA-1>
              <MD5>e2612c1d9ae6723c462cd2852d904121</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>libyaml-0-2.dll</name>
        <report_id>fdc04ed1-ccf9-4642-b8ae-6cd287f8599d</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>anti-vm</value>
          <value>crypto</value>
          <value>mingw</value>
          <value>anti-debug</value>
          <value>evasive</value>
          <value>packed</value>
          <value>overlay</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e53fdd9064425e9afc7ed04be76ef4bf16dd1ec14b7bc240201075f57351ef87</id>
    <title>Analysis Report for e53fdd9064425e9afc7ed04be76ef4bf16dd1ec14b7bc240201075f57351ef87</title>
    <updated>2026-10-05T12:25:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac397d7d130e7ad45267813</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac39734766af099f2b3b532</flow_id>
        <hash>e53fdd9064425e9afc7ed04be76ef4bf16dd1ec14b7bc240201075f57351ef87</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>ac5f3197ad09a1fbb3167fbed029820f8db737eadb24c9cd31700cd447a99058</SHA-256>
              <SHA-1>bf1e08f3e0ee7579931229117a42023413a659c4</SHA-1>
              <MD5>2aba82c99c712eb87b0a3691888fa34a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>libffi-8.dll</name>
        <report_id>0b29940b-e9f2-4e9a-aab6-42e98abf1b03</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>anti-vm</value>
          <value>crypto</value>
          <value>anti-debug</value>
          <value>evasive</value>
          <value>packed</value>
          <value>overlay</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e9d089c2a37ffe723da198aa79abd5fcf404e620cd0a7b3aaa4428ea7f180c8f</id>
    <title>Analysis Report for e9d089c2a37ffe723da198aa79abd5fcf404e620cd0a7b3aaa4428ea7f180c8f</title>
    <updated>2026-10-05T12:25:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac397e3d130e7ad45267817</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac39734766af099f2b3b532</flow_id>
        <hash>e9d089c2a37ffe723da198aa79abd5fcf404e620cd0a7b3aaa4428ea7f180c8f</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schemas.microsoft.com/SMI/2016/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.ruby-lang.org/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.ruby-lang.org/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>ruby-lang.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>ruby-lang.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>150.171.109.107</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.108.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>14e70694ff4cbe19d1a575c6716a065e2f5c82a2cf854d396d740dce616d2043</SHA-256>
              <SHA-1>3537ca40018008a90fc5eecb90ca264ca22d3953</SHA-1>
              <MD5>9a049723ee8deabd12f67d3394aa9141</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>203bd62c351108cf1ba15b1c67a77610af557be85d781c7c61ab88ff72bae6c3</SHA-256>
              <SHA-1>c7627b41b11429256e1cd60b8d4c2aff2f53da80</SHA-1>
              <MD5>36dae17942c15f1873398e23e1315f57</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>2456af95a5b2cd81b277179d9284768e7278b3f41d8ca1990f7ec5e479070eb8</SHA-256>
              <SHA-1>12d0ddda93d4d6db72baa76b5f02de0383057358</SHA-1>
              <MD5>c5ae4e17ae15d06919c29982e161000f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>3a42ec00d842909312978cc48b571b5d32b2f64def32d335222c1c16199b83ac</SHA-256>
              <SHA-1>0e0eedf89d1dd412e7833479b05cef37853a8d36</SHA-1>
              <MD5>4b3f67ead0b6938235b8c9f05d9b1a32</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>5c30e7dbe206abe728055059c2e486fdc7ab429576b724e5aec44093aa0c2907</SHA-256>
              <SHA-1>19ba9c753a6d1ab3205e2ea0560d170b9bb0bdb1</SHA-1>
              <MD5>41ca91ee2ba227160d79f39e181603b6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>77a1efb6136f52dd2372987b13bf486aa75baeacb93bad009aa3e284c57b8694</SHA-256>
              <SHA-1>99ce74251d19d800608e30bed6e0d793931da56e</SHA-1>
              <MD5>1ec6a7b3300970378c29695a6cc13d36</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>c7c78534645afe49551bbf71fcfb90a2d89c2b44134e220ac21b873b3ff5d55c</SHA-256>
              <SHA-1>fade6d09b3a31578da39a8118bb9b0fae815101f</SHA-1>
              <MD5>57d5679e0026ec028c5c2187b86cbd5c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>fbe82192289e45ae6c2514f13e6145db58465d2e367a5e257fda7afd249607c0</SHA-256>
              <SHA-1>abcace507213943c9a2beb6e6c551cc4e9267625</SHA-1>
              <MD5>0892aa1e24a808565c6bf5cbfb09fb2c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>feb8ec8489cdba0dd9e4b24672f75a8e2bfe689e883857d811c651d0b29db873</SHA-256>
              <SHA-1>15d2f69b9e81c5caf79afb935be815c488fa5368</SHA-1>
              <MD5>a04c6fcbf8e74cd1abfbf6d4cc3a0043</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>f432f8424cbcda4d08a2f8b79c7af47a95aaa5b29834e1ed295d825df3fb0e78</SHA-256>
              <SHA-1>2a0d116bbc71529faf0e57db90533aa97889b584</SHA-1>
              <MD5>1a458c981d78e90b2ab1b6ca1c637160</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>rubyw.exe</name>
        <report_id>bc903fac-360c-437f-b533-1956ce61aa88</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>anti-vm</value>
          <value>crypto</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>dbcdfe4d57794d696ebfb10e54df329ab608e5699d48aee662bf66c1da82cc05</id>
    <title>Analysis Report for dbcdfe4d57794d696ebfb10e54df329ab608e5699d48aee662bf66c1da82cc05</title>
    <updated>2026-10-05T12:25:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3979fd130e7ad452677f0</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac39734766af099f2b3b532</flow_id>
        <hash>dbcdfe4d57794d696ebfb10e54df329ab608e5699d48aee662bf66c1da82cc05</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>c82cf330388994ebc03365fe767e44b93faee5137254a14ee30b4de0f063a9e7</SHA-256>
              <SHA-1>19492ef8f5e6c89db697adde80c3e999053f1b80</SHA-1>
              <MD5>54cc20a5e268ab4dfcb794a69cf85a56</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>libgcc_s_dw2-1.dll</name>
        <report_id>d67b1b03-350c-40fa-8c4d-0aea13507050</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>anti-vm</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>overlay</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>2aeed87bcd39f797ef6b2f1bd8058bc9be48a2c9aab51e9936a159c50152f2b0</id>
    <title>Analysis Report for 2aeed87bcd39f797ef6b2f1bd8058bc9be48a2c9aab51e9936a159c50152f2b0</title>
    <updated>2026-10-05T12:25:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac397acd130e7ad452677f6</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac39734766af099f2b3b532</flow_id>
        <hash>2aeed87bcd39f797ef6b2f1bd8058bc9be48a2c9aab51e9936a159c50152f2b0</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.openssl.org/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.openssl.org/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>openssl.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>openssl.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>34.49.79.89</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>0cc86a641c8289a79cc98cf24f27bef79e18b4a8756186bea3aec92ac59662f6</SHA-256>
              <SHA-1>b3f5a6388d3468eacc9bd6d550144c11c62e4aa3</SHA-1>
              <MD5>1915295d8bb7c087501d3565ef60ee3a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>6af4a7699256911eecce166d9bf4bd7fa10ed069fd629ae266befafa0f276682</SHA-256>
              <SHA-1>fff4b18f866398f1d5483290aea803c1750aeca4</SHA-1>
              <MD5>82743a82ddd7cbe861c5ca665fef6cf3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>68c59656ef2bf8e0691e4999848ce6ef2148fab43ee06b62e7208e69d57c1042</SHA-256>
              <SHA-1>faf7e626813ce56259199633aace6b4800093453</SHA-1>
              <MD5>7aca51907e421cf0397a2697cd003cf9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>libssl-3.dll</name>
        <report_id>0635678f-747e-4bce-a5d2-c4c340d8b435</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>pedll</value>
          <value>anti-vm</value>
          <value>reconnaissance</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>overlay</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>08c9b7c0fa5478ef290b33f8d77adc5915d6771671ac22582f8b2aa90fa65eb0</id>
    <title>Analysis Report for 08c9b7c0fa5478ef290b33f8d77adc5915d6771671ac22582f8b2aa90fa65eb0</title>
    <updated>2026-10-05T12:25:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39803d130e7ad45267821</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac39734766af099f2b3b532</flow_id>
        <hash>08c9b7c0fa5478ef290b33f8d77adc5915d6771671ac22582f8b2aa90fa65eb0</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.openssl.org/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>openssl.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>appro@openssl.org</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>34.49.79.89</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>2cedbf3fc81cf7d75ce7feb74295b90b9b34bfc5486960a19b7d078c1c6b4bd4</SHA-256>
              <SHA-1>c013349a6248339b08c3836ee10b531f7e1248e3</SHA-1>
              <MD5>b2e678e414bbbc30de1dbe06b87312cd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>4b494987af826786c2b80845cce0275a7d5cfa43f66a4fcc438983a7100c1f4d</SHA-256>
              <SHA-1>f8d3e8a88e1e5d30241bad789c7d39d539aa13ff</SHA-1>
              <MD5>e709c90de40f76c509bb254362c99672</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>68c59656ef2bf8e0691e4999848ce6ef2148fab43ee06b62e7208e69d57c1042</SHA-256>
              <SHA-1>faf7e626813ce56259199633aace6b4800093453</SHA-1>
              <MD5>7aca51907e421cf0397a2697cd003cf9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>libcrypto-3.dll</name>
        <report_id>5b89ad3c-6398-40ed-bf58-7e04e5262411</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>pedll</value>
          <value>anti-vm</value>
          <value>certreq</value>
          <value>crypto</value>
          <value>expand</value>
          <value>lolbin</value>
          <value>reconnaissance</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>base64</value>
          <value>packed</value>
          <value>overlay</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ab3888745ca79f6f3888dab36110802ed2114ee024beb5694093ee1508126a56</id>
    <title>Analysis Report for ab3888745ca79f6f3888dab36110802ed2114ee024beb5694093ee1508126a56</title>
    <updated>2026-10-05T12:25:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39783d130e7ad452677e4</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac39734766af099f2b3b532</flow_id>
        <hash>ab3888745ca79f6f3888dab36110802ed2114ee024beb5694093ee1508126a56</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>e34d6258f4845e99b6a469e244462b5d11346a2dcc47e28df23fdddfa08ec648</SHA-256>
              <SHA-1>0c459dca413b84693512350aa042309ab75232d8</SHA-1>
              <MD5>eeb4912f4dd58d9e8d4841445533ce33</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>00000200-0000-0000-0000-000000000000</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>libgmp-10.dll</name>
        <report_id>cac20de9-8418-4908-8c0a-c842bbf985f2</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>anti-vm</value>
          <value>crypto</value>
          <value>mingw</value>
          <value>anti-debug</value>
          <value>evasive</value>
          <value>packed</value>
          <value>overlay</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a741bbb7a3a15220f67a037c7c4c952cf1d63e1b75916b4079f91b248c5eb29e</id>
    <title>Analysis Report for a741bbb7a3a15220f67a037c7c4c952cf1d63e1b75916b4079f91b248c5eb29e</title>
    <updated>2026-10-05T12:25:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39791d130e7ad452677ea</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac39734766af099f2b3b532</flow_id>
        <hash>a741bbb7a3a15220f67a037c7c4c952cf1d63e1b75916b4079f91b248c5eb29e</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.mingw-w64.org/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mingw-w64.org/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>mingw-w64.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>mingw-w64.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>88.99.69.85</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>31c0824121da3d508ce39f98d5b9a7b8f81498fff8d37d8dcffcefbddaab36f6</SHA-256>
              <SHA-1>685e987ca201528447728b8e6bc6be393741b7e3</SHA-1>
              <MD5>1a2aaae8b1933b05fe475e9c9e46c566</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>73465561f9a61ac0850e8571bb5795854d3a53cef65685a5d34e7ca946cc643e</SHA-256>
              <SHA-1>81472745535f6821c4bc3c6b2aa8d175b8352572</SHA-1>
              <MD5>906978af7cf24df41a793fcba8d39326</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>e5beea1847782d583051a37f57db4410f3295139852b289987e2e420b6216c35</SHA-256>
              <SHA-1>3daae82f6ac8a8fea67c3963b1447554caef0477</SHA-1>
              <MD5>c227708acc9dfb1b60563fe6ec17d799</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>libwinpthread-1.dll</name>
        <report_id>4de84a53-262b-4b31-9fc3-5c91c24c5e02</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>pedll</value>
          <value>evasive</value>
          <value>masquerade</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>overlay</value>
          <value>anti-vm</value>
          <value>crypto</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>b83e25801e91154fd3296df11b0b340f3b087fc39b278b0630ab65645e46a0f0</id>
    <title>Analysis Report for b83e25801e91154fd3296df11b0b340f3b087fc39b278b0630ab65645e46a0f0</title>
    <updated>2026-10-05T12:25:04Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39788d130e7ad452677e5</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6ac3972031f292eab9b4fecf</flow_id>
        <hash>b83e25801e91154fd3296df11b0b340f3b087fc39b278b0630ab65645e46a0f0</hash>
        <iocs>
          <urls>
            <value>
              <url>file:///tmp/tmpxltkvs2j.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1HPxO-ZwEd6M19tu3RTAO6THVppSte4w</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1T9ue1xRU2xjrBkczknxzu0KP1Rdr3Qk</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1UQgx8gCLYVG5VZL77CpIVewzzI5kbNR</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1oJmSkNDm0aDBeh9b-mNtcM8pLYJj0C7</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1HPxO-ZwEd6M19tu3RTAO6THVppSte4wFfSXvZip29fc/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1T9ue1xRU2xjrBkczknxzu0KP1Rdr3QkGrcs0B9g2jLg/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1UQgx8gCLYVG5VZL77CpIVewzzI5kbNRJAF8QzFJPtww/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1oJmSkNDm0aDBeh9b-mNtcM8pLYJj0C7LiINitwCHiHU/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1HPxO-ZwEd6M19tu3RTAO6THVppSte4wFfSXvZip29fc/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1T9ue1xRU2xjrBkczknxzu0KP1Rdr3QkGrcs0B9g2jLg/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1UQgx8gCLYVG5VZL77CpIVewzzI5kbNRJAF8QzFJPtww/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1oJmSkNDm0aDBeh9b-mNtcM8pLYJj0C7LiINitwCHiHU/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>docs.google.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>docs.google.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>docs.google.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.13.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>092855b955f885e5788367022c3aa29f23c59fc175adba64ca21a9ddd49601bd</SHA-256>
              <SHA-1>42e9bb7a10164a02551eaa6a74781ead3484ae63</SHA-1>
              <MD5>1f239e2e8f445304dfdc582cc9ff2c05</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/html</file_type>
            </value>
            <value>
              <SHA-256>665f85012a1af2237e113e6ae1a6d791a205a275c619be3cf0b49458cc769f32</SHA-256>
              <SHA-1>9b56d1e9a33ec157514ef178ae2c4b6aa09df61b</SHA-1>
              <MD5>4e7f4af1a858826ea0577a2feafb0a97</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>ed91f77780bcdcc45e1c2c829cee852dff29b3b5de2de46deb13eebbcb4e54d4</SHA-256>
              <SHA-1>3f515b218c8246c066cc0a8deca0ef1283c2ada5</SHA-1>
              <MD5>a4df9f95d1f616a7b907ceaf46fcec81</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>58b2405d7f85d0dd5b46df78e7e8bca2e0e17da67d0de66df682831ccd54b122</SHA-256>
              <SHA-1>0be5894064f4583623feb55ab0d6196fc16be56f</SHA-1>
              <MD5>292d766c6216a6095216b7fc03f0e823</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>b268c5a3fcb3a427121204a1c62a15f73db05ca1c6ec997d1c594852b4c30296</SHA-256>
              <SHA-1>5e6f54e197ed26713f5c3043b31365d687633c05</SHA-1>
              <MD5>f74da458f4dfaecd405255aeb67b5d6a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>a3a239aeb05246fc88b083f75d6b6065413921f54712db7d6549790ea8587e41</SHA-256>
              <SHA-1>2c4f2bb5a5235398520220d7ff722d2f13f90eb0</SHA-1>
              <MD5>2d6e2aee4bd36077697af1894cbb9375</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>5430c3219e72d4b744051e5ef0cca3102a84cc1783ea678346a9ce3f737fc4bf</SHA-256>
              <SHA-1>32a9eb569370c24d3a4df1dd86d4f677eb55e205</SHA-1>
              <MD5>b0dea1e9a2a21b6acbef63ceb28bfba7</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>aaab272509bda3d300ace77cdaa123421f36ac5f483b121404c750a745c8e0c7</SHA-256>
              <SHA-1>e4c6fb4ca2ad5e14f8246ff92e444cf68f968b48</SHA-1>
              <MD5>2a273cdaadfe207dc9d80f89a56b18d0</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>3c734918f62e1c3d879d2ac3899285023f194dfdc683e2ee73f1abf2a5f66854</SHA-256>
              <SHA-1>113ffdfaa285dc220060b660e4c1b2c148f97975</SHA-1>
              <MD5>c65b38191b6b5cdd51649defeac39595</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>submission.eml</name>
        <report_id>dbcbe752-d816-471f-b8d9-ac132a666851</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8086908965620ff6f1cd3bf27500953a5e61fc602ea453d2d3784fef14286665</id>
    <title>Analysis Report for 8086908965620ff6f1cd3bf27500953a5e61fc602ea453d2d3784fef14286665</title>
    <updated>2026-10-05T12:24:31Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39767d130e7ad452677d4</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6ac396feedc8b0d17b00363a</flow_id>
        <hash>8086908965620ff6f1cd3bf27500953a5e61fc602ea453d2d3784fef14286665</hash>
        <iocs>
          <urls>
            <value>
              <url>http://upx.sf.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>upx.sf.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.18.21.237</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>f07678bd16df1e713cac0c04bd2eb0b3d2accfb98c589f6f63911d6f32ad1fa7</SHA-256>
              <SHA-1>ffe97378bfd32bb3d9919a016b38ede4aa2fcfdb</SHA-1>
              <MD5>20773388c0245f547b47d7b0a47b8850</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>upx-bin</name>
        <report_id>b152bf2f-0af6-40e7-8c35-bcfac42b86c1</report_id>
        <tags>
          <value>elf</value>
          <value>html</value>
          <value>packed</value>
          <value>upx</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>01486e26ee31d0ab20b773bf0bdff8265a937faa22f18ae3ee725bfa1832aaac</id>
    <title>Analysis Report for 01486e26ee31d0ab20b773bf0bdff8265a937faa22f18ae3ee725bfa1832aaac</title>
    <updated>2026-10-05T12:23:55Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3974fd130e7ad452677cd</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6ac396da31f292eab9b4fd66</flow_id>
        <hash>01486e26ee31d0ab20b773bf0bdff8265a937faa22f18ae3ee725bfa1832aaac</hash>
        <iocs/>
        <name>dnscrypt-proxy</name>
        <report_id>925b7170-f570-48ec-b22c-c903211a6275</report_id>
        <tags>
          <value>elf</value>
          <value>golang</value>
        </tags>
        <verdict>UNKNOWN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d5752f7a97721282da65b8cc9fa3522aa39b0d90df1b95b40468f1c13a0accad</id>
    <title>Analysis Report for d5752f7a97721282da65b8cc9fa3522aa39b0d90df1b95b40468f1c13a0accad</title>
    <updated>2026-10-05T12:23:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39715d130e7ad452677bc</_id>
        <file_type>text/javascript</file_type>
        <flow_id>6ac396b1766af099f2b3b44b</flow_id>
        <hash>d5752f7a97721282da65b8cc9fa3522aa39b0d90df1b95b40468f1c13a0accad</hash>
        <iocs/>
        <name>PO_4700252644_R0_Supply_260787_pdf.js</name>
        <report_id>83785280-90e5-4741-8e6c-e76e694587e9</report_id>
        <tags>
          <value>javascript</value>
          <value>attrib</value>
          <value>powershell</value>
          <value>masquerade</value>
          <value>evasive</value>
          <value>obfuscated</value>
          <value>repaired</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>33967fc9d5e7550dbf66f500586e9e9ca78b412474bd48e801bbb1c3cbf8e7e1</id>
    <title>Analysis Report for 33967fc9d5e7550dbf66f500586e9e9ca78b412474bd48e801bbb1c3cbf8e7e1</title>
    <updated>2026-10-05T12:22:54Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3970bd130e7ad452677b8</_id>
        <file_type>application/vnd.ms-outlook</file_type>
        <flow_id>6ac3969b766af099f2b3b41e</flow_id>
        <hash>33967fc9d5e7550dbf66f500586e9e9ca78b412474bd48e801bbb1c3cbf8e7e1</hash>
        <iocs>
          <urls>
            <value>
              <url>http://interpol.it-login.net/a065ceab-64e6-4912-8d9b-3e20ea4d9790</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://interpol.it-login.net/avvertimenti/globale/chatGPT/8c5f7bb6-e4c2-4f33-99d3-6a27b3190e2d</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/exif/1.0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/photoshop/1.0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/tiff/1.0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/mm</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/sType/ResourceEvent</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.w3.org/1999/02/22-rdf-syntax-ns</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>http://interpol.it-login.net/a065ceab-64e6-4912-8d9b-3e20ea4d9790</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://interpol.it-login.net/avvertimenti/globale/chatGPT/8c5f7bb6-e4c2-4f33-99d3-6a27b3190e2d</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://interpol.it-login.net/a065ceab-64e6-4912-8d9b-3e20ea4d9790</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://interpol.it-login.net/avvertimenti/globale/chatGPT/8c5f7bb6-e4c2-4f33-99d3-6a27b3190e2d</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/exif/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/photoshop/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/tiff/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/mm</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/sType/ResourceEvent</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schema.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.hornetsecurity.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://interpol.it-login.net/a065ceab-64e6-4912-8d9b-3e20ea4d9790</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://interpol.it-login.net/avvertimenti/globale/chatGPT/8c5f7bb6-e4c2-4f33-99d3-6a27b3190e2d</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.w3.org/1999/02/22-rdf-syntax-ns</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>interpol.it-login.net</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>ns.adobe.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>w3.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>hornetsecurity.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>interpol.it-login.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>ns.adobe.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schema.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>interpol.it-login.net</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>w3.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>interpol.it-login.net</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>AVVERTIMENTI@CYBERSECURITY.INTERPOL.IT-FILE.NET</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>FC399CED59FD1349B02C71D1B2C75A9A@eurprd01.prod.exchangelabs.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>avvertimenti@cybersecurity.inter__substg1.0_5D01001F</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>avvertimenti@cybersecurity.interpol.it-file.net</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>extern.matthias.colognese@volkswagengroup.it</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>mail.security@volkswagengroup.it__substg1.0_5D0A001F</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>riccardo.soddu@volkswagengroup.it</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>support@hornetsecurity.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>104.18.23.19</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>94.100.132.71</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.88.214.116</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>10.167.8.43</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>94.100.132.73</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>2485959d14bbc817dc623eeab443c9ce526c1a088163172d26be6664f56751f0</SHA-256>
              <SHA-1>bbb37374abed0cb9eabb587fc842da4bd08a055b</SHA-1>
              <MD5>adacc9f58c633dd3ea79f665312cf833</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>d28b4c447c0d0c644bdd9a4b12492a0767ac98bbb9e4de223130a7aa19227b7d</SHA-256>
              <SHA-1>d8fdf00ad3f9cff08ebafa350fde9bd95beb2622</SHA-1>
              <MD5>1b04361463c35b691581c360e9320e25</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>711ca3686f4b4c3c66ab7efe3bfa20d61fd5ac8c3f33fcebe76094fa86df9585</SHA-256>
              <SHA-1>c9076f6d13b9579754e317138efeadc631a7647e</SHA-1>
              <MD5>a1189757d5a5f72812dcc0403fd6aed8</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>661c25e6686e7e00eaed18285f2dad075348f2d5f98b61650b0de9fff197962d</SHA-256>
              <SHA-1>39105140bd7442eb7df3b45444fcd34d845b132b</SHA-1>
              <MD5>c934faa56d3aee08205faec46bb57060</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>fb2a02198ace8955cb3693e6114e34c5b230c565ca2906c244632ff6ce943e98</SHA-256>
              <SHA-1>d60fe98a96ee992726b9ab37696fe8e7b281245f</SHA-1>
              <MD5>48df93a6dfb089d8930dc8c8241a4498</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>3057b83458be81e01b9c73e2bc7d3691361aa90aa2ad37e336fa9919ac5d7185</SHA-256>
              <SHA-1>15f518d4530c985c1bc0027adede580dc107b988</SHA-1>
              <MD5>522693d225992f511e1cdd8dbb1301ba</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>8c5f7bb6-e4c2-4f33-99d3-6a27b3190e2d</uuid>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <uuid>a065ceab-64e6-4912-8d9b-3e20ea4d9790</uuid>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <uuid>8c5f7bb6-e4c2-4f33-99d3-6a27b3190e2d</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>a065ceab-64e6-4912-8d9b-3e20ea4d9790</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>8c5f7bb6-e4c2-4f33-99d3-6a27b3190e2d</uuid>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <uuid>a065ceab-64e6-4912-8d9b-3e20ea4d9790</uuid>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <uuid>0f6f68be-4ef2-465a-986b-eb9a250d9789</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>55734034-b3ac-467a-b6cd-1c799038e05a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>6580c7cc-daf3-43b1-b4ad-83209be897ce</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8c5f7bb6-e4c2-4f33-99d3-6a27b3190e2d</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>a065ceab-64e6-4912-8d9b-3e20ea4d9790</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>cf484498-f0cd-431a-4962-08df22b9a371</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>dfc9cb8e-228c-451f-9d4c-65e6477633ca</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>ff7ca204-c26f-40fb-b7fc-813440d3f44a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>EXT Avviso Interpol - Enorme minaccia identificata dalluso di ChatGPT.msg</name>
        <report_id>97daec64-54ef-42fb-8aed-14dd518ef844</report_id>
        <tags>
          <value>msg</value>
          <value>ole</value>
          <value>html</value>
          <value>png</value>
          <value>anti-vm</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0926f6f79fcac8bc7e1e1e7027743a37662a1db79464fd24dc12c6c199ddee21</id>
    <title>Analysis Report for 0926f6f79fcac8bc7e1e1e7027743a37662a1db79464fd24dc12c6c199ddee21</title>
    <updated>2026-10-05T12:22:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac396ccd130e7ad452677a5</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac39677edc8b0d17b00346f</flow_id>
        <hash>0926f6f79fcac8bc7e1e1e7027743a37662a1db79464fd24dc12c6c199ddee21</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a</SHA-256>
              <SHA-1>cac699787884fb993ced8d7dc47b7c522c7bc734</SHA-1>
              <MD5>b7db84991f23a680df8e95af8946f9c9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>9436ae1a057be09efe7217708587a37c966c84d50bb93eb523eb69749f566498</SHA-256>
              <SHA-1>8ef60a5746e4427fce7201240bfa43f17d3968d7</SHA-1>
              <MD5>4ba89ffe5e5e610365adc8c07776cfe2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>7b104e2184e343d35f618a3dcb27d6e914dd9e9ac6430e618421f17b0ceeec4e</SHA-256>
              <SHA-1>abccc9a8483ac5ce2e9564d6f748808e5592d71a</SHA-1>
              <MD5>4094fb446d221c06e886c421bb502b64</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>8d22bc92ff706c8528bb3082eee6aba5dcb7423db9d3ffbd9108356ec5aa1a85</SHA-256>
              <SHA-1>ac7e61ca77aaa906aa939f21735a9289b47ea25a</SHA-1>
              <MD5>06f42a3e6fbfc05d4278d40e50b077de</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>afe7265d12560e2f4791d755b19d6336ce32374980e2b2e30b97baf10b85e17a</SHA-256>
              <SHA-1>f3f32f74e6980edb9ab24693a1d1dad1ccf37b7a</SHA-1>
              <MD5>55a2a8b660fca9304ec31aebabb71417</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>dbfc821bf0408c8aaa37bcbae958f6e461156a18ff4b4d8111b99c18cf018f42</SHA-256>
              <SHA-1>05bb2147ed2dc309ea4745887cb260cf0fe9e85a</SHA-1>
              <MD5>c1d58fd269fbc21ab3c5a38af02854d6</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>e5faceee9b09734b57d9caae4d6553dc4081863fcca2ab6d2f07f53b5d3fbd8b</SHA-256>
              <SHA-1>2446e2c576bb3db73c81e1ed28e3bbcfb320eee3</SHA-1>
              <MD5>88dffa6597436d91956427a69af7a5f9</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>f9c97a620258652fca9ba87f8cb84f6dc1fcc17d5d9fcf4c008158c008c97078</SHA-256>
              <SHA-1>2154cf7697abc313f18c553cb2509145ae1e91d5</SHA-1>
              <MD5>62741c6b3c6a12d4e52b242b61eaea10</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
          </files>
        </iocs>
        <name>Teklif Talebi  1540-0092RFQ26_202606100623256209 .bat.exe</name>
        <report_id>e2228467-5df0-4e05-9c8b-a3995f855497</report_id>
        <tags>
          <value>peexe</value>
          <value>dotnet_pe</value>
          <value>masquerade</value>
          <value>packed</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>905d4a66d5324e154d976bbf88829d4d9263815a2b97cc40954f06d4a23c28eb</id>
    <title>Analysis Report for 905d4a66d5324e154d976bbf88829d4d9263815a2b97cc40954f06d4a23c28eb</title>
    <updated>2026-10-05T12:21:54Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac396a8d130e7ad45267798</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac3965f31f292eab9b4fb26</flow_id>
        <hash>905d4a66d5324e154d976bbf88829d4d9263815a2b97cc40954f06d4a23c28eb</hash>
        <iocs>
          <urls>
            <value>
              <url>http://upx.tsx.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://wildsau.idv.uni-linz.ac.at/mfx/upx.html</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.nexus.hu/upx</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://upx.tsx.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://wildsau.idv.uni-linz.ac.at/mfx/upx.html</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.nexus.hu/upx</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>nexus.hu</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>upx.tsx.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>wildsau.idv.uni-linz.ac.at</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>nexus.hu</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>upx.tsx.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>wildsau.idv.uni-linz.ac.at</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>markus.oberhumer@jk.uni-linz.ac.at</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>ml1050@cdata.tvnet.hu</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>markus.oberhumer@jk.uni-linz.ac.at</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>ml1050@cdata.tvnet.hu</email>
              <origin>CONTENT_PARSE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>195.56.77.47</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>77.247.182.246</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>7efb6191ecd20dfddd3246d84ca9204d2fc3f28b15cddacbba41b86787270849</SHA-256>
              <SHA-1>4e17f62fc91f80a0caa90d61e382ecc0178a9657</SHA-1>
              <MD5>16e972f379c8f0dc6dc1fd614ec72ba7</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>96f5cd77a9c83ca5867b1be56a59c92b0ee2a0b700417ee27f354045c032fd26</SHA-256>
              <SHA-1>16fcb0aad486e9fa5a0c079d9bab518090580248</SHA-1>
              <MD5>7bbdadf46b735916413e6f3ccbe703f0</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>c030bc4ddac5a02154f4a6b3de6b027cb06971cf67f7955159b8a2ebc5c53abf</SHA-256>
              <SHA-1>61a30f6934395253fefd21598d02ae0c14340279</SHA-1>
              <MD5>2813957fcc1b5f28f112487bc4d5c51e</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>application/json</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>LICENSE</name>
        <report_id>17d8c703-ee77-41b2-a415-60924193946a</report_id>
        <tags>
          <value>txt</value>
          <value>html</value>
          <value>json</value>
          <value>base64</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8086908965620ff6f1cd3bf27500953a5e61fc602ea453d2d3784fef14286665</id>
    <title>Analysis Report for 8086908965620ff6f1cd3bf27500953a5e61fc602ea453d2d3784fef14286665</title>
    <updated>2026-10-05T12:21:54Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac396b9d130e7ad4526779e</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6ac3965f31f292eab9b4fb26</flow_id>
        <hash>8086908965620ff6f1cd3bf27500953a5e61fc602ea453d2d3784fef14286665</hash>
        <iocs>
          <urls>
            <value>
              <url>http://upx.sf.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>upx.sf.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.18.20.237</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>63661d41f08531971864c967797993e341bfbdf245f1cf94e6a1f81113259e2f</SHA-256>
              <SHA-1>e153c9168d498952e137fff8f33c86c4b1561441</SHA-1>
              <MD5>f58f5b4b065632100c9c3a9fd04ce4e0</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>upx</name>
        <report_id>362ed1d7-5cb6-4ea9-918e-778f3e4bd53a</report_id>
        <tags>
          <value>elf</value>
          <value>html</value>
          <value>packed</value>
          <value>upx</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8a94e57e68e85928fd5a6ca9fe7a29cf768db11184f36ceff52b07f6b6277030</id>
    <title>Analysis Report for 8a94e57e68e85928fd5a6ca9fe7a29cf768db11184f36ceff52b07f6b6277030</title>
    <updated>2026-10-05T12:21:54Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac396d3d130e7ad452677a8</_id>
        <file_type>application/xhtml+xml</file_type>
        <flow_id>6ac3965f31f292eab9b4fb26</flow_id>
        <hash>8a94e57e68e85928fd5a6ca9fe7a29cf768db11184f36ceff52b07f6b6277030</hash>
        <iocs>
          <urls>
            <value>
              <url>http://www.oberhumer.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.tmt.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://freemint.github.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://upx.github.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>file:///tmp/tmpfnp54fua.html</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>freemint.github.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>oberhumer.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>tmt.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>upx.github.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>github@gmail.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>jreiser@BitWagon.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>markus@oberhumer.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>130.162.50.189</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.109.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>193.170.194.40</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>f07678bd16df1e713cac0c04bd2eb0b3d2accfb98c589f6f63911d6f32ad1fa7</SHA-256>
              <SHA-1>ffe97378bfd32bb3d9919a016b38ede4aa2fcfdb</SHA-1>
              <MD5>20773388c0245f547b47d7b0a47b8850</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>b3cc3523a022fa2b653d791eee93fc51dcee79e3a555a7ad39ca9078cdbbde16</SHA-256>
              <SHA-1>8d0f0d1c8f8d09e0cf7f13f1bee3ee5203348a99</SHA-1>
              <MD5>b933e8c2ef3097dc3b30b44971225e6a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>bcff21050c37dcf204dbf2ebc25e52b385f9fbe141a53e6e8b765dc01ddde584</SHA-256>
              <SHA-1>52a82dbf23e93d640f2acfea8fd7a73096bc8a31</SHA-1>
              <MD5>6ffeb07549b5f62124c277b60dee1936</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>cd797ef1fdc6f4c032ae4c7002cd5258fb71be2d7be711b595ba8896773dd345</SHA-256>
              <SHA-1>13c8a8c929a80e605081c72619f199b529873c44</SHA-1>
              <MD5>12f4212d54c9fd045a7930355acc40fa</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>upx-doc.html</name>
        <report_id>d81f41f3-1c3e-44a4-87f0-460d1a825a78</report_id>
        <tags>
          <value>html</value>
          <value>xml</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643</id>
    <title>Analysis Report for 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643</title>
    <updated>2026-10-05T12:21:54Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac396a5d130e7ad45267796</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac3965f31f292eab9b4fb26</flow_id>
        <hash>8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643</hash>
        <iocs/>
        <name>COPYING</name>
        <report_id>b078587a-d31a-46ee-9406-b1a5a540781e</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8a94e57e68e85928fd5a6ca9fe7a29cf768db11184f36ceff52b07f6b6277030</id>
    <title>Analysis Report for 8a94e57e68e85928fd5a6ca9fe7a29cf768db11184f36ceff52b07f6b6277030</title>
    <updated>2026-10-05T12:21:53Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac396c089017dd18dc1c163</_id>
        <file_type>application/xhtml+xml</file_type>
        <flow_id>6ac3966031f292eab9b4fb31</flow_id>
        <hash>8a94e57e68e85928fd5a6ca9fe7a29cf768db11184f36ceff52b07f6b6277030</hash>
        <iocs>
          <urls>
            <value>
              <url>http://www.oberhumer.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.tmt.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://freemint.github.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://upx.github.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>file:///tmp/tmpka_nf3bg.html</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>freemint.github.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>oberhumer.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>tmt.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>upx.github.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>github@gmail.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>jreiser@BitWagon.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>markus@oberhumer.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>185.199.109.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>193.170.194.40</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>130.162.50.189</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.110.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>f3f3767e66b2a2e0637f356eb16ae7c1dadd24b5b4960bbee4ad517e71b1199e</SHA-256>
              <SHA-1>4fbd509355923010f4e21afb137e592708f5fdc7</SHA-1>
              <MD5>6d2fb9b79584257b072a02960135bdf3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>f07678bd16df1e713cac0c04bd2eb0b3d2accfb98c589f6f63911d6f32ad1fa7</SHA-256>
              <SHA-1>ffe97378bfd32bb3d9919a016b38ede4aa2fcfdb</SHA-1>
              <MD5>20773388c0245f547b47d7b0a47b8850</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>bcff21050c37dcf204dbf2ebc25e52b385f9fbe141a53e6e8b765dc01ddde584</SHA-256>
              <SHA-1>52a82dbf23e93d640f2acfea8fd7a73096bc8a31</SHA-1>
              <MD5>6ffeb07549b5f62124c277b60dee1936</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>c1c330aaf9978f3b63d2ef4e2cd1de4468fbc20c4b033f2fb0ed76fb2dfb519a</SHA-256>
              <SHA-1>0327e033ad04e4e8e64782807c7bbbeeb8a2e9ef</SHA-1>
              <MD5>67893ce1f5528f761268e70d6eee32f7</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>upx-doc.html</name>
        <report_id>3848108f-b3bc-4ff3-8881-2404fd945734</report_id>
        <tags>
          <value>html</value>
          <value>xml</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>905d4a66d5324e154d976bbf88829d4d9263815a2b97cc40954f06d4a23c28eb</id>
    <title>Analysis Report for 905d4a66d5324e154d976bbf88829d4d9263815a2b97cc40954f06d4a23c28eb</title>
    <updated>2026-10-05T12:21:53Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac396d989017dd18dc1c16d</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac3966031f292eab9b4fb31</flow_id>
        <hash>905d4a66d5324e154d976bbf88829d4d9263815a2b97cc40954f06d4a23c28eb</hash>
        <iocs>
          <urls>
            <value>
              <url>http://upx.tsx.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://wildsau.idv.uni-linz.ac.at/mfx/upx.html</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.nexus.hu/upx</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://upx.tsx.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://wildsau.idv.uni-linz.ac.at/mfx/upx.html</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.nexus.hu/upx</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>nexus.hu</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>upx.tsx.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>wildsau.idv.uni-linz.ac.at</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>nexus.hu</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>upx.tsx.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>wildsau.idv.uni-linz.ac.at</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>markus.oberhumer@jk.uni-linz.ac.at</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>ml1050@cdata.tvnet.hu</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>markus.oberhumer@jk.uni-linz.ac.at</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>ml1050@cdata.tvnet.hu</email>
              <origin>CONTENT_PARSE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>195.56.77.47</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>77.247.182.246</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>12aa440f6306af9005adfcb45a4370564d922e64f63f7e9aad38898303b11e7f</SHA-256>
              <SHA-1>f251bb293ad51563ab5ad3b37dce6eb97a5c8615</SHA-1>
              <MD5>9ee3c082df1b5ef5ed46c4c97a5ca149</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>f336057ab6668c75f604d478df8e2d7e500b260b5e93e215cce9150463627970</SHA-256>
              <SHA-1>37a5c30593348a289020047f20a950c6f9332b99</SHA-1>
              <MD5>16223bd8829a1041322cbd3cbad5d6b8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>8b1dc22f9acea163cf47478da2b673d6c56c7736d67bb0ae70f582b4bc4dda05</SHA-256>
              <SHA-1>28935fecca51ccf50b6706da85ecaf964c8b038c</SHA-1>
              <MD5>3cbf0b78f6b51e64f7494041ca37b278</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>application/json</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>LICENSE</name>
        <report_id>c06ba3ac-3319-4ec8-8705-c30bb159920e</report_id>
        <tags>
          <value>txt</value>
          <value>xml</value>
          <value>html</value>
          <value>json</value>
          <value>base64</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8086908965620ff6f1cd3bf27500953a5e61fc602ea453d2d3784fef14286665</id>
    <title>Analysis Report for 8086908965620ff6f1cd3bf27500953a5e61fc602ea453d2d3784fef14286665</title>
    <updated>2026-10-05T12:21:53Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac396b389017dd18dc1c15e</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6ac3966031f292eab9b4fb31</flow_id>
        <hash>8086908965620ff6f1cd3bf27500953a5e61fc602ea453d2d3784fef14286665</hash>
        <iocs>
          <urls>
            <value>
              <url>http://upx.sf.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>upx.sf.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.18.20.237</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>f07678bd16df1e713cac0c04bd2eb0b3d2accfb98c589f6f63911d6f32ad1fa7</SHA-256>
              <SHA-1>ffe97378bfd32bb3d9919a016b38ede4aa2fcfdb</SHA-1>
              <MD5>20773388c0245f547b47d7b0a47b8850</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>upx</name>
        <report_id>e3e956c0-3eeb-442e-82b0-f41b2a7bd1a9</report_id>
        <tags>
          <value>elf</value>
          <value>html</value>
          <value>packed</value>
          <value>upx</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643</id>
    <title>Analysis Report for 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643</title>
    <updated>2026-10-05T12:21:53Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac396d889017dd18dc1c16c</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac3966031f292eab9b4fb31</flow_id>
        <hash>8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643</hash>
        <iocs/>
        <name>COPYING</name>
        <report_id>c21ce992-c3c4-4fe0-9e94-192c31952626</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d731a96b091d9ac570404f3bfd862c2635765f0e315df6a047c4abac34d9cf9e</id>
    <title>Analysis Report for d731a96b091d9ac570404f3bfd862c2635765f0e315df6a047c4abac34d9cf9e</title>
    <updated>2026-10-05T12:21:23Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac396bbd130e7ad452677a0</_id>
        <file_type>application/epub+zip</file_type>
        <flow_id>6ac39642edc8b0d17b0033fc</flow_id>
        <hash>d731a96b091d9ac570404f3bfd862c2635765f0e315df6a047c4abac34d9cf9e</hash>
        <iocs>
          <urls>
            <value>
              <url>http://www.disastercenter.com/crime/uscrime.htm</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.highscope.org/research</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.highscope.org/research/Perry%20fact%20sheet.htm</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.idpf.org/2007/ops</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.pewtrusts.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.pewtrusts.org/~/media/assets/2014/09/pspp_crime_webgraphic.pdf?la=en</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.statcan.gc.ca/pub/85-002-x/2012001/article/11715-eng.pdf</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.statcan.gc.ca/pub/85-002-x/2016001/article/14642-eng.htm</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.w3.org/1999/xhtml</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.bjs.gov/content/pub/pdf/cpop93bk.pdf</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.gov.uk/government/statistics/historical-crime-data</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.ons.gov.uk/peoplepop</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.ons.gov.uk/peoplepopulation</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.ons.gov.uk/peoplepopulationandcommunity/crimeandjustice/bulletins/crimeinenglandandwales/yearendingjune2016</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.ons.gov.uk/peoplepopulationandcommunity/crimeandjustice/bulletins/crimeinenglandandwales/yearendingmar2017#what-is-happening-to-trends-in-crime</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>bjs.gov</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>disastercenter.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>gov.uk</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>highscope.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>idpf.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>ons.gov.uk</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>pewtrusts.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>statcan.gc.ca</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>w3.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>141.193.213.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.175.139.208</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.45.130.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.23.19</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>149.101.82.172</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.67.174.10</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>206.188.192.140</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>18.169.209.99</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>151.101.0.144</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>876d2573aa20728ad2fb4a0f3ac8d7fc6bde86a184cb83ad8d821217cb674aaa</SHA-256>
              <SHA-1>3256a03aadaabb301c1d75b1e45d62c59ed62ad8</SHA-1>
              <MD5>92796ad132118b5febef1f860bbc882f</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
            </value>
            <value>
              <SHA-256>1380a545a953593a14281195260983106f0d0e8b8836c8320b025e42d4599902</SHA-256>
              <SHA-1>ffd6c128fcf3f42bc8ea39794c8c976019d0afaa</SHA-1>
              <MD5>298cc7d6e929abba3ee7f6f07d553b23</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>ab920cafe0500d4994d5a4242b99409ec5f6ec2145ed4bef8d3dd3de377d14a3</SHA-256>
              <SHA-1>0facdc0e413188d5cff5a8b83a2ab9206bc10a86</SHA-1>
              <MD5>48a715e7bc20b1b018a71c5a90a747bb</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>fc7cdcba0099d2cd9f7fb9d0d2c9ca3040578e4c4a8a48c9dd59e96316c835ff</SHA-256>
              <SHA-1>8c106208a9d60f303c436c71edccf847eef5776e</SHA-1>
              <MD5>aec1b7266afcd9b8c9b0fe9be71cc5f3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>dd5100d9c1355e01344e03e6cd005f9017b3abe63e8a9a608374a39289da04bc</SHA-256>
              <SHA-1>bc34a8110a5d6b5e43616717b478cf138f8166ec</SHA-1>
              <MD5>f605de7feb4dd53a4e1e71b88890e83f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/pdf</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>a552e1dd68f93dd6dd3670ba182ce3e34b354a47e17e281bd2ff2b61b06f6398</SHA-256>
              <SHA-1>fd2be93df24a0768d534f08e9d63d29274687a60</SHA-1>
              <MD5>69dd5ccfaa2912a9a2866f3fd9d73ba2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>98878a1db5dd591059bd2fb819944620d82cff63eb8297f37e35f4c3206fbc1d</SHA-256>
              <SHA-1>7d04a68aedfadf43db15490ba36e174d38fbe97e</SHA-1>
              <MD5>a2d85661b3848f5078612f5ea12d7766</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>20d9c7e548a2a40b5a3a32fa290842287460ca932e34bf8484b35d68ab5b5192</SHA-256>
              <SHA-1>5401be19259d2551749e41f06d172a09d1565920</SHA-1>
              <MD5>623e962fb5e3c266014edd0bc604b6f6</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/pdf</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>a0f02dc5f73b8e6f423242f9520c5a5a067ada87c10763b6b272ef7c2c87820a</SHA-256>
              <SHA-1>79b827319a2989de043ee8a094365ec6f1a77baa</SHA-1>
              <MD5>a19a60af0ad920a9fb03d30b04c0573f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/pdf</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>10b0d022-5d0a-43fb-8735-5e5e45589e91</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>Criminology A Very Short Introduction (Tim Newburn) (z-library.sk, 1lib.sk, z-lib.sk).epub</name>
        <report_id>2679db67-2f46-455c-be50-bca56067db4e</report_id>
        <tags>
          <value>pdf</value>
          <value>html</value>
          <value>epub</value>
          <value>form</value>
          <value>macros</value>
          <value>obfuscated</value>
          <value>captcha</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>853d2e32283bc6399131a16ba40b23036096a968691ef6df2bfef620d19b22a1</id>
    <title>Analysis Report for 853d2e32283bc6399131a16ba40b23036096a968691ef6df2bfef620d19b22a1</title>
    <updated>2026-10-05T12:19:52Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3965389017dd18dc1c144</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac395e531f292eab9b4f921</flow_id>
        <hash>853d2e32283bc6399131a16ba40b23036096a968691ef6df2bfef620d19b22a1</hash>
        <iocs>
          <ips>
            <value>
              <ip>13.107.4.52</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>131.107.255.255</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>17.253.109.201</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>17.253.113.202</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>192.0.0.170</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>192.0.0.171</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>2.16.106.89</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>2.16.106.91</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>216.239.35.0</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.0.175.137</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.0.175.146</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.192.47.155</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.192.47.203</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.199.63.160</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.199.63.184</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.199.63.208</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.204.146.160</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.204.146.163</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.46.238.243</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.46.239.24</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.48.39.16</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.48.39.48</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.55.38.139</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.55.38.146</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.59.190.185</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.59.190.195</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.162.100</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.162.101</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.162.102</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.162.113</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.162.138</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.162.139</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.162.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.164.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.165.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.177.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.185.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>74.125.132.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>74.125.136.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>74.125.20.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>74.125.21.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>74.125.28.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>13.107.4.52</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>131.107.255.255</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>17.253.109.201</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>17.253.113.202</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>192.0.0.170</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>192.0.0.171</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>2.16.106.89</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>2.16.106.91</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>216.239.35.0</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.0.175.137</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.0.175.146</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.192.47.155</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.192.47.203</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.199.63.160</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.199.63.184</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.199.63.208</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.204.146.160</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.204.146.163</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.46.238.243</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.46.239.24</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.48.39.16</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.48.39.48</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.55.38.139</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.55.38.146</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.59.190.185</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.59.190.195</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.162.100</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.162.101</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.162.102</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.162.113</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.162.138</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.162.139</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.162.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.164.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.165.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.177.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.185.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>74.125.132.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>74.125.136.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>74.125.20.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>74.125.21.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>74.125.28.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
          </ips>
        </iocs>
        <name>example-captive-portals.txt</name>
        <report_id>13e8cbef-aa30-4a61-94b6-e0288ccca18c</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a0b4bcefa211dce4ee3c7ab5f92c783c336f1bcf1f5ffe29d861449c09051254</id>
    <title>Analysis Report for a0b4bcefa211dce4ee3c7ab5f92c783c336f1bcf1f5ffe29d861449c09051254</title>
    <updated>2026-10-05T12:19:52Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3965089017dd18dc1c140</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac395e531f292eab9b4f921</flow_id>
        <hash>a0b4bcefa211dce4ee3c7ab5f92c783c336f1bcf1f5ffe29d861449c09051254</hash>
        <iocs/>
        <name>example-allowed-names.txt</name>
        <report_id>d0cdbab9-d4b7-4b42-b859-788ac13902e9</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0542c3582f49b19f6c0a6aa42bff12d49c56b442c60e39393bfcf62ce036c408</id>
    <title>Analysis Report for 0542c3582f49b19f6c0a6aa42bff12d49c56b442c60e39393bfcf62ce036c408</title>
    <updated>2026-10-05T12:19:52Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3965289017dd18dc1c142</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac395e531f292eab9b4f921</flow_id>
        <hash>0542c3582f49b19f6c0a6aa42bff12d49c56b442c60e39393bfcf62ce036c408</hash>
        <iocs/>
        <name>example-blocked-names.txt</name>
        <report_id>e2e7774d-1520-4e1a-8ce8-081042792cb2</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0542c3582f49b19f6c0a6aa42bff12d49c56b442c60e39393bfcf62ce036c408</id>
    <title>Analysis Report for 0542c3582f49b19f6c0a6aa42bff12d49c56b442c60e39393bfcf62ce036c408</title>
    <updated>2026-10-05T12:19:50Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39627d130e7ad4526776f</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac395e331f292eab9b4f916</flow_id>
        <hash>0542c3582f49b19f6c0a6aa42bff12d49c56b442c60e39393bfcf62ce036c408</hash>
        <iocs/>
        <name>example-blocked-names.txt</name>
        <report_id>7f01583c-4698-4454-8c15-0ed45882c72c</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>853d2e32283bc6399131a16ba40b23036096a968691ef6df2bfef620d19b22a1</id>
    <title>Analysis Report for 853d2e32283bc6399131a16ba40b23036096a968691ef6df2bfef620d19b22a1</title>
    <updated>2026-10-05T12:19:50Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39652d130e7ad4526777b</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac395e331f292eab9b4f916</flow_id>
        <hash>853d2e32283bc6399131a16ba40b23036096a968691ef6df2bfef620d19b22a1</hash>
        <iocs>
          <ips>
            <value>
              <ip>13.107.4.52</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>131.107.255.255</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>17.253.109.201</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>17.253.113.202</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>192.0.0.170</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>192.0.0.171</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>2.16.106.89</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>2.16.106.91</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>216.239.35.0</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.0.175.137</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.0.175.146</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.192.47.155</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.192.47.203</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.199.63.160</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.199.63.184</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.199.63.208</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.204.146.160</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.204.146.163</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.46.238.243</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.46.239.24</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.48.39.16</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.48.39.48</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.55.38.139</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.55.38.146</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.59.190.185</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>23.59.190.195</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.162.100</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.162.101</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.162.102</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.162.113</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.162.138</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.162.139</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.162.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.164.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.165.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.177.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>64.233.185.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>74.125.132.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>74.125.136.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>74.125.20.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>74.125.21.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>74.125.28.94</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>13.107.4.52</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>131.107.255.255</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>17.253.109.201</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>17.253.113.202</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>192.0.0.170</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>192.0.0.171</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>2.16.106.89</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>2.16.106.91</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>216.239.35.0</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.0.175.137</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.0.175.146</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.192.47.155</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.192.47.203</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.199.63.160</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.199.63.184</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.199.63.208</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.204.146.160</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.204.146.163</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.46.238.243</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.46.239.24</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.48.39.16</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.48.39.48</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.55.38.139</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.55.38.146</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.59.190.185</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>23.59.190.195</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.162.100</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.162.101</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.162.102</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.162.113</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.162.138</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.162.139</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.162.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.164.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.165.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.177.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>64.233.185.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>74.125.132.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>74.125.136.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>74.125.20.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>74.125.21.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <ip>74.125.28.94</ip>
              <origin>CONTENT_PARSE</origin>
            </value>
          </ips>
        </iocs>
        <name>example-captive-portals.txt</name>
        <report_id>d3663ab3-0265-4cdb-a487-a1ed3190db43</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a0b4bcefa211dce4ee3c7ab5f92c783c336f1bcf1f5ffe29d861449c09051254</id>
    <title>Analysis Report for a0b4bcefa211dce4ee3c7ab5f92c783c336f1bcf1f5ffe29d861449c09051254</title>
    <updated>2026-10-05T12:19:50Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39626d130e7ad4526776b</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac395e331f292eab9b4f916</flow_id>
        <hash>a0b4bcefa211dce4ee3c7ab5f92c783c336f1bcf1f5ffe29d861449c09051254</hash>
        <iocs/>
        <name>example-allowed-names.txt</name>
        <report_id>7bf1484b-247b-48fc-aae8-578bba03ad50</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0bffb316ef5ba0e1e87b6bc490893b1de3b07997790ba7948c4ecb173817c746</id>
    <title>Analysis Report for 0bffb316ef5ba0e1e87b6bc490893b1de3b07997790ba7948c4ecb173817c746</title>
    <updated>2026-10-05T12:19:26Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac395ead130e7ad45267758</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac395cd31f292eab9b4f8c4</flow_id>
        <hash>0bffb316ef5ba0e1e87b6bc490893b1de3b07997790ba7948c4ecb173817c746</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.epey.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.epey.com/cdn-cgi/challenge-platform/h/b/jsd/oneshot/d76008a69eab/0.26058978097515806:1791201915:CjJN65vJn2Y5n-SuqNpHFvUVR4Dc8p5NWnoOVu_WTgg/a45c600d6bc9dbf6</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.epey.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/d76008a69eab/main.js?</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.epey.com/cdn-cgi/images/browser-bar.png?1376755637</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.epey.com/cdn-cgi/images/cf-no-screenshot-error.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.epey.com/cdn-cgi/styles/cf.errors.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.epey.com/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.epey.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>www.cloudflare.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.epey.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.16.123.96</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.20.35.87</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>c413639e586d4738303714745bcdef56ec3985d0714c7d944a5e9f0118ac0b34</SHA-256>
              <SHA-1>bba2b6a4220fb6a4d775420309a16fbf0040e6de</SHA-1>
              <MD5>a184032bcf6f24ce2abe4fd6e9c62ab7</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://www.epey.com</name>
        <report_id>5e389f92-cfdc-4f6d-b694-3c12b5cbf8bb</report_id>
        <tags>
          <value>html</value>
          <value>phishing</value>
          <value>captcha</value>
          <value>aidetect</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>87cec0a6bd267fb9de2940944f63be73c17b66c5ed5c1a25d28c0ea61543fe05</id>
    <title>Analysis Report for 87cec0a6bd267fb9de2940944f63be73c17b66c5ed5c1a25d28c0ea61543fe05</title>
    <updated>2026-10-05T12:18:40Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac395c9d130e7ad4526774f</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac3959f7e4998b7d6180767</flow_id>
        <hash>87cec0a6bd267fb9de2940944f63be73c17b66c5ed5c1a25d28c0ea61543fe05</hash>
        <iocs>
          <urls>
            <value>
              <url>https://mylocalsocials.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/_next/static/chunks/1255-7b4b5a04291b6a94.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/_next/static/chunks/2619-04bc32f026a0d946.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/_next/static/chunks/2663-15bd144f38bff73c.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/_next/static/chunks/4bd1b696-100b9d70ed4e49c1.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/_next/static/chunks/6489-9f5dcbace9d19dbe.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/_next/static/chunks/app/error-29cdc3dc0c733763.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/_next/static/chunks/app/layout-458f65aaf7cb2d35.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/_next/static/chunks/app/not-found-44ae003937987549.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/_next/static/chunks/app/page-a4a736f02a14cc59.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/_next/static/chunks/app/register/page-3e24ff397d9792f6.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/_next/static/chunks/main-app-f3336e172256d2ab.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/_next/static/chunks/webpack-75ea9f08c81a5a5d.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/_next/static/css/7e7d96b1e6991756.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/_next/static/css/a1adf47f91965040.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/_next/static/media/e4af272ccee01ff0-s.p.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/api/auth/session</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/login?_rsc=1p-R_iEY6bj0jY31</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com/register?_rsc=1p-R_iEY6bj0jY31</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mylocalsocials.com</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>mylocalsocials.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>3.22.147.86</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxps://mylocalsocials.com</name>
        <report_id>6507082f-0ee0-400e-9b2b-84bd1eef7d25</report_id>
        <tags>
          <value>html</value>
          <value>aidetect</value>
          <value>phishing</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T12:18:24Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3959e89017dd18dc1c10f</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac3958f31f292eab9b4f78d</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>6169ab91-622b-42c2-980d-9a891e78c57a</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T12:18:19Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39599d130e7ad45267741</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39589edc8b0d17b003209</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>0917ea48-6835-421c-a2c7-c76f8d35b255</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0a9e97d4b6aa05e3c84fc0ebaeb0aff12aba335154f821c05d5220e37dea5e30</id>
    <title>Analysis Report for 0a9e97d4b6aa05e3c84fc0ebaeb0aff12aba335154f821c05d5220e37dea5e30</title>
    <updated>2026-10-05T12:18:10Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac395b5d130e7ad45267748</_id>
        <file_type>application/vnd.android.package-archive</file_type>
        <flow_id>6ac39581edc8b0d17b0031dc</flow_id>
        <hash>0a9e97d4b6aa05e3c84fc0ebaeb0aff12aba335154f821c05d5220e37dea5e30</hash>
        <iocs>
          <urls>
            <value>
              <url>https://goo.gle/compose-feedback</url>
              <origin>APK_DECODING</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>goo.gle</url>
              <origin>APK_DECODING</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>67.199.248.13</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>93c008ecc46eb4d16ff90435c44e5c75e8b6df3a0a45ba242c774d790d85f846</SHA-256>
              <SHA-1>fa07f604364406c08beed1588ae9a55a51bf6260</SHA-1>
              <MD5>a6eab93d5d6158533715744ec560dc04</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>Picture Mushroom - Mushroom ID v2.10.0 b97 arm7+arm64 9 _ed by youarefinished.apk</name>
        <report_id>aa231479-1eb6-4b1e-9e32-4dc7965e98ee</report_id>
        <tags>
          <value>apk</value>
          <value>html</value>
          <value>explorer</value>
          <value>lolbin</value>
          <value>obfuscated</value>
          <value>persistence</value>
          <value>signed</value>
          <value>base64</value>
          <value>evasive</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>20d5a4893788205e923413b2a13b4e5e8e40e57ff01e651c5662c9a530a46786</id>
    <title>Analysis Report for 20d5a4893788205e923413b2a13b4e5e8e40e57ff01e651c5662c9a530a46786</title>
    <updated>2026-10-05T12:17:19Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39555d130e7ad4526772a</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6ac3954c4c2119a4a085705c</flow_id>
        <hash>20d5a4893788205e923413b2a13b4e5e8e40e57ff01e651c5662c9a530a46786</hash>
        <iocs/>
        <name>20d5a4893788205e923413b2a13b4e5e8e40e57ff01e651c5662c9a530a46786.elf</name>
        <report_id>bcd85133-b738-4c67-a6ab-b09d78f01547</report_id>
        <tags>
          <value>elf</value>
          <value>rust</value>
        </tags>
        <verdict>UNKNOWN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>70ed41327068060f68a7272cc705ba1eecfa11430e308023eb82d7964f42ed1d</id>
    <title>Analysis Report for 70ed41327068060f68a7272cc705ba1eecfa11430e308023eb82d7964f42ed1d</title>
    <updated>2026-10-05T12:16:37Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3955bd130e7ad4526772d</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac39521766af099f2b3b0ec</flow_id>
        <hash>70ed41327068060f68a7272cc705ba1eecfa11430e308023eb82d7964f42ed1d</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>991d1204779ab8912bb060b6f149b256c217381eee98fb57ce514f0027441fef</SHA-256>
              <SHA-1>6cd3bf13ddec0912edee623097e1d4ecf3c36451</SHA-1>
              <MD5>0601e800bbc824bc20421a389c708277</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>e319082c23faa07865238e06844382d181ad3cdab44bcfaea7836fd601dba857</SHA-256>
              <SHA-1>56db47a26a1651682e783a02e5123f76d6effd92</SHA-1>
              <MD5>a162f87d777e2631927c2ead8ba75cf1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <SHA-256>c858cae9560a78009cb981f38495c9bea62dec5859b3b404995a7e5f18229ddf</SHA-256>
              <SHA-1>70898416f2dcc04dd70257aad14fc02df36082bf</SHA-1>
              <MD5>64683e623c1c6c5b9018fde04674c848</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
          </files>
        </iocs>
        <name>AIO Checker 8.10.10.exe</name>
        <report_id>60b12de8-2a90-464a-89f3-5c8bf70db66b</report_id>
        <tags>
          <value>peexe</value>
          <value>lummastealer</value>
          <value>masquerade</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>overlay</value>
          <value>microsoft_visual_cc</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>6e46aee072b26d2c00f60cab73b7c601cbe836f7acde314d430f8e70538a26ee</id>
    <title>Analysis Report for 6e46aee072b26d2c00f60cab73b7c601cbe836f7acde314d430f8e70538a26ee</title>
    <updated>2026-10-05T12:16:27Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3955dd130e7ad4526772f</_id>
        <file_type>application/vnd.android.package-archive</file_type>
        <flow_id>6ac3951a766af099f2b3b0d9</flow_id>
        <hash>6e46aee072b26d2c00f60cab73b7c601cbe836f7acde314d430f8e70538a26ee</hash>
        <iocs>
          <urls>
            <value>
              <url>https://goo.gle/compose-feedback</url>
              <origin>APK_DECODING</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>goo.gle</url>
              <origin>APK_DECODING</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>67.199.248.13</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>1a1c293b8614543614240cb75bd0a78f2bd3f8a908b41681b4bc4b924f55c587</SHA-256>
              <SHA-1>2f202f2e71513df10d2fbba43e2e8d444090f822</SHA-1>
              <MD5>5a83b8e4130580a2723cfc5f9665783b</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>PictureThis - Plant Identifier v5.36.0 b5094 arm7+arm64 9 Patched by youarefinished.apk</name>
        <report_id>1e1435bb-7c6a-4660-a0ec-faf7f87ee530</report_id>
        <tags>
          <value>apk</value>
          <value>html</value>
          <value>signed</value>
          <value>obfuscated</value>
          <value>base64</value>
          <value>evasive</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>4bb957e55360ae037e790622340f6369c94653f190fb5e533c05729564156284</id>
    <title>Analysis Report for 4bb957e55360ae037e790622340f6369c94653f190fb5e533c05729564156284</title>
    <updated>2026-10-05T12:16:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39565d130e7ad45267730</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac3950d7e4998b7d6180661</flow_id>
        <hash>4bb957e55360ae037e790622340f6369c94653f190fb5e533c05729564156284</hash>
        <iocs>
          <urls>
            <value>
              <url>http://172.16.99.5/IPC</url>
              <origin>UNC_PATH</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://192.168.56.20/IPC</url>
              <origin>UNC_PATH</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>MALICIOUS</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>MALICIOUS</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>172.16.99.5</ip>
              <origin>UNC_PATH</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <ip>192.168.56.20</ip>
              <origin>UNC_PATH</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <ip>77.247.179.88</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.16.99.5</ip>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <ip>192.168.56.20</ip>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>07c567b05ce0f958b79914fdc397b86eaa3a75fb449af7f41160b88d75e5084b</SHA-256>
              <SHA-1>687ae66aa44313b153e51e5604cc868708012a2a</SHA-1>
              <MD5>91e4f7a6ecdb52f38944722b095a86fe</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>0d6e0c1d757d72371aff96cb5282be0b005943e7fb2bf24a4319542e13dd08ae</SHA-256>
              <SHA-1>e743455d0e5ef9214bb057548b1cb2c5f72adb20</SHA-1>
              <MD5>35f2f352cbf0f85d79fe3da9901244d6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>222d66035f8166c7156952fbf90056fd3324f44e092f48b748ec55c6433c8a81</SHA-256>
              <SHA-1>b5d960a6b2f1dbc4d03998de448f7fed815f4fe1</SHA-1>
              <MD5>e71e115f8e7dc8988d0c002535e65229</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>44bfc1a666e1354fe936899af8495921f330ec1abfd877fb79d4308e2d872f25</SHA-256>
              <SHA-1>8756f27eb1dc3b4880f3a7f37e8c2e77371e45f5</SHA-1>
              <MD5>b05f390633f891e9b5a44c636f3c1716</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>49c5ce265f978a0edaa37838c9f243bcb83c035432a26b5fdbee3b7f45f253ae</SHA-256>
              <SHA-1>b98afadc3150c9395280aabacf19fe0321723003</SHA-1>
              <MD5>d838b6f718747f0a35d7a5751121bfc6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>5844dcf2a798a647155a7747060b79dc45fbe2e151b32eb3fd293cf92a028db5</SHA-256>
              <SHA-1>386334de243bf2332d33b5726c3468aca2273ccc</SHA-1>
              <MD5>35eaa9ccd13f3040ac80d577cd59c124</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>9a894c8dcf4cbf2e5ad40ec794b5cfba0f3ce24e7ccd024578f6de68086ffa1c</SHA-256>
              <SHA-1>9e19b7dc9693b5078ebe6b65092e2222a209ce2b</SHA-1>
              <MD5>ebb2b9e8bfbde5e90fa97ccd28d61485</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>9ae7e6f91d6131c58f5e66f311fed4d79bb774b92e9ad2121a3e67ba5f42896c</SHA-256>
              <SHA-1>2fb1c4521e997af418f0238e0f7320cea99162e0</SHA-1>
              <MD5>d9736131f04a925c0bdad496a69ffb17</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>b485eb970f88227144eb3fd22fcd954726e2bec5e8d9ee44d2934c136f58368e</SHA-256>
              <SHA-1>a0554c94045f94416084c7bb0d4b8260ab4ec5d1</SHA-1>
              <MD5>5256d0fcfd356b08f8495a57313d747d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>bfbb7a945b3c706458b5ca6f9706e140edb97af9ec7939e9c224894cf89dbc8e</SHA-256>
              <SHA-1>777fa835b4e136a1b6797b4e51ed4dc86716d04e</SHA-1>
              <MD5>78b8f33bb57fe0c98802b4f61f13528f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>c170638f031cc5fcc32da114f9d03f2b83ac8e55d2f3bfa8a32368fb03b9d193</SHA-256>
              <SHA-1>125746859e15f8dc5fd09c9fb3e2a111b815f087</SHA-1>
              <MD5>8835719c78b098e034dd474d22698883</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>c76e3b5830a6f0cf16debf40ed6fc3da75f7a93a4cbad635429b6dd693dbf4f8</SHA-256>
              <SHA-1>ddec2ef5214e06213652396cb34e1c48172ee442</SHA-1>
              <MD5>22f4f1633fb9921c3614b6c2578344ac</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c88bacac039f30ebd1a3b8fa2b231ea2cfb4e599e8f521004a9bfbf7db16cd58</SHA-256>
              <SHA-1>72ffdf20676bf2418c6ce9e809adeffdf44c4d02</SHA-1>
              <MD5>67b2f152ec61b0c641fcb7df37b6bc18</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>e4d0c23f53549e718af6cfc73a471717985d50c150d846b561169f4c51d57d9f</SHA-256>
              <SHA-1>bd42b327c1dd95352a81f7d10289a3109ac201c8</SHA-1>
              <MD5>dca0d4821f6fb1031c401b456dbc6dff</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>e73cbe0447e9df674b059b6c2b4936ecfdcc71580acd316a9582785a71391ebe</SHA-256>
              <SHA-1>a5e923c71e5369c5e5a99c7beffdeb0665f5fcea</SHA-1>
              <MD5>bbde80d67d41c5bb795f2a3661a30e02</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>f0a408a7cfe435c8bc58fd16eaa8616960e5b2fb3ca239cd1e9d7a32373827df</SHA-256>
              <SHA-1>9a1ae7c170e4591287dd38dddd7c7cd642ffe2fb</SHA-1>
              <MD5>195bf3aa3b7cc49fd470a473e9243c0f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>f7b74bf682e6dc378bb1b90a5064ec9827a2e23e4e4781b7f9a5bc183b0a3eea</SHA-256>
              <SHA-1>0e0bec155b72c0f20534cc67097887ad7247169a</SHA-1>
              <MD5>e17a3c09c23a3ed800a4aeccc4bcdc7b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>097d7deaea191ffd32704320d7250808250786eb9f290a450d6af90a7260846b</SHA-256>
              <SHA-1>0255f793d4c116c5963ebc2d082988e84dc875a2</SHA-1>
              <MD5>79a60e396c939eac56c6ad4962bb51b2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>7b40951e15ab85aeb667dbfd13fa04003241c1e7bf6eca1e0cb0765850558f0e</SHA-256>
              <SHA-1>3f801c73436d909013ce2df0970e4b99a50cad3f</SHA-1>
              <MD5>4e4c89a1a85328317d06617101cb3b09</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>application/json</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>4bb957e55360ae037e790622340f6369c94653f190fb5e533c05729564156284.exe</name>
        <report_id>ca71d609-e21d-47c6-8a8d-e6c332961285</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>html</value>
          <value>json</value>
          <value>wannacryptor</value>
          <value>ransomware</value>
          <value>packed</value>
          <value>overlay</value>
          <value>anti-debug</value>
          <value>cmd</value>
          <value>lolbin</value>
          <value>crypto</value>
          <value>smb</value>
          <value>base64</value>
          <value>obfuscated</value>
          <value>microsoft_visual_cc</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>1e67a657db76e435e71bf415296975c61cafa49d5ff219ac641431eb5928f376</id>
    <title>Analysis Report for 1e67a657db76e435e71bf415296975c61cafa49d5ff219ac641431eb5928f376</title>
    <updated>2026-10-05T12:14:18Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac394edd130e7ad45267717</_id>
        <file_type>application/x-powershell</file_type>
        <flow_id>6ac39497edc8b0d17b002ced</flow_id>
        <hash>1e67a657db76e435e71bf415296975c61cafa49d5ff219ac641431eb5928f376</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>e66086cef5fba8785d446e370109d9e0ed52df8132a0a96725b898c7e8e0681e</SHA-256>
              <SHA-1>5314fafc9f6a0937ed018cdd6d5be2a3c64e036f</SHA-1>
              <MD5>a63f0c6c4c8701ecb82b4dcd4bc273e0</MD5>
              <origin>POWERSHELL_EMULATION</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>02685f22-b4a7-47c4-a464-0b0cc6bbaa3a</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>1e67a657db76e435e71bf415296975c61cafa49d5ff219ac641431eb5928f376.bin.ps1</name>
        <report_id>b0073c51-4d2d-4662-a087-526dcb265d8b</report_id>
        <tags>
          <value>powershell</value>
          <value>evasive</value>
          <value>obfuscated</value>
          <value>aes</value>
          <value>aspnet_compiler</value>
          <value>crypto</value>
          <value>encrypted</value>
          <value>lolbin</value>
          <value>masquerade</value>
          <value>reconnaissance</value>
          <value>base64</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>dd81171bc6c8137ea1630eddfdb4234116b8293c5e4e33d5ba857686d04b9bfd</id>
    <title>Analysis Report for dd81171bc6c8137ea1630eddfdb4234116b8293c5e4e33d5ba857686d04b9bfd</title>
    <updated>2026-10-05T12:14:16Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac394f589017dd18dc1c0ec</_id>
        <file_type>application/x-powershell</file_type>
        <flow_id>6ac39498766af099f2b3af66</flow_id>
        <hash>dd81171bc6c8137ea1630eddfdb4234116b8293c5e4e33d5ba857686d04b9bfd</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>e66086cef5fba8785d446e370109d9e0ed52df8132a0a96725b898c7e8e0681e</SHA-256>
              <SHA-1>5314fafc9f6a0937ed018cdd6d5be2a3c64e036f</SHA-1>
              <MD5>a63f0c6c4c8701ecb82b4dcd4bc273e0</MD5>
              <origin>POWERSHELL_EMULATION</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>02685f22-b4a7-47c4-a464-0b0cc6bbaa3a</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>dd81171bc6c8137ea1630eddfdb4234116b8293c5e4e33d5ba857686d04b9bfd.bin.ps1</name>
        <report_id>a8de665b-3430-4420-8fd6-a8ec4198769b</report_id>
        <tags>
          <value>powershell</value>
          <value>evasive</value>
          <value>obfuscated</value>
          <value>aes</value>
          <value>aspnet_compiler</value>
          <value>crypto</value>
          <value>encrypted</value>
          <value>lolbin</value>
          <value>masquerade</value>
          <value>reconnaissance</value>
          <value>base64</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f04d72c584d21762e4dae4def1e84410b38d374df7cff3a6cd1a7be41e0ffba0</id>
    <title>Analysis Report for f04d72c584d21762e4dae4def1e84410b38d374df7cff3a6cd1a7be41e0ffba0</title>
    <updated>2026-10-05T12:14:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac394bad130e7ad4526770a</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6ac39496766af099f2b3af64</flow_id>
        <hash>f04d72c584d21762e4dae4def1e84410b38d374df7cff3a6cd1a7be41e0ffba0</hash>
        <iocs>
          <urls>
            <value>
              <url>https://docs.google.com/drawings/d/1Ij7cS5TaHrKGfR_tegaTuQ4ohqb4a2d</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1bBh9rCoSW_tuClAj98aVC14vgjgXkIt</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1thwdCsGQ0hkgf8LcO3oAXsbgBN-sEjp</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1Ij7cS5TaHrKGfR_tegaTuQ4ohqb4a2dNHKViWPwIoJU/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1bBh9rCoSW_tuClAj98aVC14vgjgXkItK9ITdU0BIXwg/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1thwdCsGQ0hkgf8LcO3oAXsbgBN-sEjpkOgxZ2sBnCXE/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1yrhPHJpGYL8Ne_cFTLkN54aQK4srSvDkJ9pW6zROWsM/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1Ij7cS5TaHrKGfR_tegaTuQ4ohqb4a2dNHKViWPwIoJU/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1bBh9rCoSW_tuClAj98aVC14vgjgXkItK9ITdU0BIXwg/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1thwdCsGQ0hkgf8LcO3oAXsbgBN-sEjpkOgxZ2sBnCXE/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1yrhPHJpGYL8Ne_cFTLkN54aQK4srSvDkJ9pW6zROWsM/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>file:///tmp/tmp2kh5ikn1.html</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>docs.google.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>docs.google.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>docs.google.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.250.154.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>a24bc9a46ce191f6b3b77f680efc8e02deab5eefc60d4d1c4ff3c7fadbf89525</SHA-256>
              <SHA-1>6d987f00d08fa12ae10d164e71934b1c7ddd19b8</SHA-1>
              <MD5>0c9aacc116090487789a0644008bc958</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/html</file_type>
            </value>
            <value>
              <SHA-256>24786ab8ca5687ac17cd485b66469b8c5a6a68b73610c14d1199482e6d2f185d</SHA-256>
              <SHA-1>f739fbea8d7d99ab28f9849726aa3768ed0067e8</SHA-1>
              <MD5>bc570e8d8b5dd41e4fe076295a05caae</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>471a1605251c162e20ab468361eb9ff86cd4d39877076770b3dbbdb7f979ff51</SHA-256>
              <SHA-1>e116cfa86bc906ca7c74155c0fafa67e801b0d4a</SHA-1>
              <MD5>18097bf020acf78787c2504f854d0708</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>d8fa77b55aac865d8517464f0f46f877040e1c88416d5d100597acba37f0d270</SHA-256>
              <SHA-1>0e3469cd23ca4a95c1a40b76e22aebae7d090307</SHA-1>
              <MD5>8d6cf1c6ed125688100d007f7c9beb3d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>1526486d4ae86b24e539adee2bd0fadb1f0a7c61b66b9c70d4c8992b11d232ca</SHA-256>
              <SHA-1>56f8f96aaaf9080df6bbe30319d985c8f54a88e3</SHA-1>
              <MD5>34b670e8aaeccaa64254a7c6100286e8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>c42b5be3179b4f35fc3c58344c6e3219ac7f66313d569aa5ed3e97e3f8f16b42</SHA-256>
              <SHA-1>203a147b32961a80ad8c5c2d6d1aa66ea700ea83</SHA-1>
              <MD5>037b91dad209a56bda9e83686db49c8d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>364670dfa635a2edea86d7dc627669aa7443077d67a4e517b163ba17484c5e4a</SHA-256>
              <SHA-1>3f38b012812774c5b657591ed155d82b906b3f58</SHA-1>
              <MD5>aead195c4382f05f44e9ed1aa2b9a4a8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>c82a86174ed13591228d6de585adc52dc51466709ed4a21727083c99b978c276</SHA-256>
              <SHA-1>801e5a79fe406092f59b035dc6834d025db09a91</SHA-1>
              <MD5>3a9afe7ca43c4e28ea55b5089c206ab5</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>submission.eml</name>
        <report_id>cdb52c06-c1af-4bea-b7cb-30bd94a02fe4</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>80263be3e025d58dfa302d55baa6e3683bf34528657f30cd947f1f5ae844323e</id>
    <title>Analysis Report for 80263be3e025d58dfa302d55baa6e3683bf34528657f30cd947f1f5ae844323e</title>
    <updated>2026-10-05T12:14:03Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac394afd130e7ad45267706</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac394897e4998b7d618055e</flow_id>
        <hash>80263be3e025d58dfa302d55baa6e3683bf34528657f30cd947f1f5ae844323e</hash>
        <iocs>
          <urls>
            <value>
              <url>https://t.me/graducnik/13</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://cdn4.telesco.pe/file/nWwOh95oOyWeKNvlV7kHxOmswJA5M-J54KGd6cpXZ-C4R6gSY3OmhPI0LSSZrS9A62U1jCR0i9Go-0dfM1pxJpSz7IWHlqpjwheOTavtwuX4sLUSd3uUppie-cpq2KYN0pL5BYMSZa_74HaA3UswNaOsp2HZRHnN-ntH9_xsAG-HpP0DottOlwJOszKB95DdJS6ksjblkAj0QC9nfOYEwzb7IpYkg4uH7F_ey6hnjnLAhGvqn8XGg-aWTbF6uyaYISp4qBNJYLBcspaJ2mKXAkWsDHUqvywxRW__V2jX5dtrfOE7-34OlOGR7wOc0iZUsJU4RSsCd6Jfv8YfgVVWqQ.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://oauth.tg.dev/js/telegram-widget.js?24</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://t.me/graducnik/13</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://t.me/graducnik/13?embed=1&amp;mode=tme</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/css/bootstrap.min.css?3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/css/font-roboto.css?1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/css/telegram.css?255</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/css/widget-frame.css?75</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/fonts/Roboto/KFOlCnqEu92Fr1MmEU9fABc4AMP6lbBP.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/fonts/Roboto/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/fonts/Roboto/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/fonts/Roboto/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/img/emoji/40/E29DA4.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/img/emoji/40/E29DA4E2808DF09F94A5.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/img/emoji/40/F09F8692.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/img/emoji/40/F09F8E84.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/img/emoji/40/F09F8E89.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/img/emoji/40/F09F9285.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/img/emoji/40/F09F94A5.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/img/emoji/40/F09F97BF.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/img/emoji/40/F09F9887.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/img/emoji/40/F09FA5B0.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/img/emoji/40/F09FABA1.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/img/tgme/pattern.svg?1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/js/telegram-widget.js?24</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/js/tgwallpaper.min.js?3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/js/widget-frame.js?68</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://telegram.org/js/telegram-widget.js?24</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://web.telegram.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>telegram.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>web.telegram.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>cdn4.telesco.pe</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>oauth.tg.dev</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>resolve</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>t.me</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>telegram.org</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>149.154.167.99</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>149.154.165.133</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>149.154.167.99</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>7f4a55f8b3642929c5e19f41fd363c938a995dceb9bb4c1c183f3e09a21164d0</SHA-256>
              <SHA-1>ade80d63eac4e6902591b4f3a5c1fdb45e9c5c6e</SHA-1>
              <MD5>72185d31a0f89aeb823542338721d3af</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>3c8c27bf6f51a778ed94f452cf6b501f54703b67ef162551f677171916fbcd99</SHA-256>
              <SHA-1>1678b99b22271f2fb879e8a2e21b40d404c00d66</SHA-1>
              <MD5>2e716528b2cdf0e610389d0aab25c3c3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://t.me/graducnik/13</name>
        <report_id>591747b5-a3e2-4900-bce1-b1d2d017c825</report_id>
        <tags>
          <value>html</value>
          <value>javascript</value>
          <value>aidetect</value>
          <value>phishing</value>
          <value>evasive</value>
          <value>obfuscated</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0094ec5eb762251bbb4e8db7ec8c9176ab4b9f91de9a69847599caeb043ecfb0</id>
    <title>Analysis Report for 0094ec5eb762251bbb4e8db7ec8c9176ab4b9f91de9a69847599caeb043ecfb0</title>
    <updated>2026-10-05T12:12:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39438d130e7ad452676e5</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac39423edc8b0d17b002aa5</flow_id>
        <hash>0094ec5eb762251bbb4e8db7ec8c9176ab4b9f91de9a69847599caeb043ecfb0</hash>
        <iocs>
          <urls>
            <value>
              <url>http://nohuvip247.top:8080</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://pro.ip-api.com/line/?key=QPVvv1rHQJD2pd2&amp;fields=25948155</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>pro.ip-api.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>nohuvip247.top</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>51.77.64.70</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.21.6.245</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>12b3cf109f2818be4874ec08d906cd6c25b76a1ded8b026045e45f5ca690de91</SHA-256>
              <SHA-1>1a30c0c0feba1b9ef5e808be8cde57f395e577cb</SHA-1>
              <MD5>3bab1ff36e4049db3035358ecf00dc5b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>251d1a64ad11c82e4af4521a5e3ae23aae468ac848da8a66eb63fd8cd056ffc4</SHA-256>
              <SHA-1>70149c8ca25a3acaf3fba794a09f68e8c5b27c16</SHA-1>
              <MD5>780b0247f1fd66812cac8be31ea76ce5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>3661c7bdf3dfbd1f349aaa80a2793d28eba5a94325cc4ad3bcee2682dff9681d</SHA-256>
              <SHA-1>8af8e6fba12027aa32a43564a46f78bc6553c3d7</SHA-1>
              <MD5>44af1d49552a06fd5a3355a002a814b8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>5655775933efda1e38ae00f0b8f85f60955669ef9bec207ebb979ecc2cecbea4</SHA-256>
              <SHA-1>0b4a680a9ff94d0fff9a538af1bece92dec547d7</SHA-1>
              <MD5>66f67de06f53b387de72d7419b257dd4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>5dd7bade4b5e9a2ddaa8dac9a1288d26c5f61c2aaa1abc1fbbbd7b970494855f</SHA-256>
              <SHA-1>2b6c852e7a922d4000b3fddaa4ee82a4218a0b2e</SHA-1>
              <MD5>65081b1d17440ed59e9e8054927a0912</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>795473e7abf0e7e7dfd7cc5edcb0fd8cff9b145a5f28f76495ddb8a99ee03ce5</SHA-256>
              <SHA-1>9d86d14aeefa55c4ca5893739374b0f7e2c8f9b0</SHA-1>
              <MD5>b23fb58bf9141f6fa37584c3d608e960</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>8e4d600d4fe2400bdcb989a8a8162212d3e5f429b9a82c1109244d856f94ab15</SHA-256>
              <SHA-1>875d1e015c3d6aa487f4185e698e95612a28faf4</SHA-1>
              <MD5>65e2dc5143bcc92ddea61c8a324a83ff</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>ad4a5aad6219f3a1fce97f7b45e787ca6947e9af37c4ee39698934208aeffa45</SHA-256>
              <SHA-1>c4d90dd338b5979f1a2169d51e745fe40c46c082</SHA-1>
              <MD5>1867677010a8b98518bbad5053c9f3fb</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>d8e086b038111b0d2ec2a284aa7464147507bbe42bf20905205482bb6b448fb4</SHA-256>
              <SHA-1>55a76be098ab76c0f3e2134e7ce7fdaea318fc46</SHA-1>
              <MD5>6eec42acd08bf787da39b691471b6254</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>eb843187cd0be9f5d0c084c1c94f1394460509fa6a98a5298cd1d479dba5c7fe</SHA-256>
              <SHA-1>c08e96b331abb657aa4b862a92d8e62cd20ccd37</SHA-1>
              <MD5>0d8d3506302f7a0d12e5ff8215b60e69</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>4849473dd3c0eb2dbb4ae2d92352e82ac11d6fa2e86b439c28d1de4960f3441e</SHA-256>
              <SHA-1>9dedbd57c2f560dd92441200951bf58c495781b6</SHA-1>
              <MD5>70b082f4bdafb5fd9299f145ad7d365b</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>fff842d8adb74c961d08ab38748e9ae3c2e90b60273c8fc37926fc190942bf47</SHA-256>
              <SHA-1>b604d5feb5143e0b78d9a2575176bdd231beb81c</SHA-1>
              <MD5>fe239c506186ca563bd4ebf66f2f682c</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>3E5FC7F9-9A51-4367-9063-A120244FBEC7</uuid>
              <origin>INPUT_FILE</origin>
              <verdict>LIKELY_MALICIOUS</verdict>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>SOFTWARE\Microsoft\Windows NT\CurrentVersion</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Run\</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Uninstall</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>app.exe</name>
        <report_id>55538614-ef30-411e-8dc1-d39c3afc106e</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>txt</value>
          <value>remcos</value>
          <value>config-extracted</value>
          <value>backdoor</value>
          <value>evasive</value>
          <value>rat</value>
          <value>exploit</value>
          <value>keylogger</value>
          <value>remoteaccesstool</value>
          <value>anti-debug</value>
          <value>explorer</value>
          <value>lolbin</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>packed</value>
          <value>microsoft_visual_cc</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa</id>
    <title>Analysis Report for ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa</title>
    <updated>2026-10-05T12:12:03Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39482d130e7ad452676f9</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac3940fedc8b0d17b002a4c</flow_id>
        <hash>ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa</hash>
        <iocs>
          <ips>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>5873c1b5b246c80ab88172d3294140a83d711cd64520a0c7dd7837f028146b80</SHA-256>
              <SHA-1>30f8820cf93a627c66195f0d77d6a409024c6e52</SHA-1>
              <MD5>b576ada3366908875e5ce4cb3da6153a</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/zip</file_type>
            </value>
            <value>
              <SHA-256>590b5bae6a9c329da6d5b836e3ec9baeb9607b8ea88e7015a01e021fc416707f</SHA-256>
              <SHA-1>4a6cdd3cb3dab86effefdf7e4b29538c45f77440</SHA-1>
              <MD5>a31cf56465371581763e9f0a86d41987</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>f8cbc0ddb17a85f2ba099416961efef915f8eba926681df7cd2c1fa69f3c2b6a</SHA-256>
              <SHA-1>466a736f7f6987b34cd7a130e26a8af13d3cf76c</SHA-1>
              <MD5>0e14014289c29078069237196bd3ea72</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>a0d1fa68d8ec94e866e0500a239e961a641ea9ecddead64963396ff82901da82</SHA-256>
              <SHA-1>44b61c1c687c4cf1ecdf67ce9af0bf058a6e835f</SHA-1>
              <MD5>603890f33930ec1aa7c1ff70864080b5</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <btc_wallets>
            <value>
              <btc_wallet>115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe</name>
        <report_id>7ee9113c-d926-42d0-a823-ed7c4ffc27a0</report_id>
        <tags>
          <value>peexe</value>
          <value>wannacryptor</value>
          <value>ransomware</value>
          <value>masquerade</value>
          <value>packed</value>
          <value>cmd</value>
          <value>lolbin</value>
          <value>reconnaissance</value>
          <value>crypto</value>
          <value>microsoft_visual_cc</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9087452bc57e6379534306b70943a742668f467215a55af47456c987e03ad916</id>
    <title>Analysis Report for 9087452bc57e6379534306b70943a742668f467215a55af47456c987e03ad916</title>
    <updated>2026-10-05T12:11:29Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39425d130e7ad452676df</_id>
        <file_type>text/x-shellscript</file_type>
        <flow_id>6ac393ef766af099f2b3ad88</flow_id>
        <hash>9087452bc57e6379534306b70943a742668f467215a55af47456c987e03ad916</hash>
        <iocs>
          <ips>
            <value>
              <ip>1.2.3.4</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
        </iocs>
        <name>wg.sh</name>
        <report_id>f64b53a1-678f-4dce-bec7-4d1d70475726</report_id>
        <tags>
          <value>shell</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>7334f1e1edd9d8bb71f10bf69910bae80a510666e4f8dc36c30be0797be9dfce</id>
    <title>Analysis Report for 7334f1e1edd9d8bb71f10bf69910bae80a510666e4f8dc36c30be0797be9dfce</title>
    <updated>2026-10-05T12:10:31Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39404d130e7ad452676d5</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac393b67e4998b7d61803fa</flow_id>
        <hash>7334f1e1edd9d8bb71f10bf69910bae80a510666e4f8dc36c30be0797be9dfce</hash>
        <iocs>
          <urls>
            <value>
              <url>http://ppjournal.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://ppjournal.org/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/&amp;format=xml</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Roboto+Serif:400%2C700%2C600%7CLora:500%2C700&amp;display=fallback&amp;ver=4.12.3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://gmpg.org/xfn/11</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org#searchaction</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ppjournal.org#website</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ppjournal.org/#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ppjournal.org/#breadcrumblist</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ppjournal.org/#logo</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ppjournal.org/#webpage</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ppjournal.org/?s=%7Bsearch_term_string%7D</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ppjournal.org/about/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/archives/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/call-for-papers/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/comments/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/contact-us/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/editorial-board/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/guidelines/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/volume-7-issue-10-2026/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.5</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.5</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.5</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/themes/astra/assets/css/minified/compatibility/contact-form-7-main.min.css?ver=4.12.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.12.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/themes/astra/assets/js/minified/flexibility.min.js?ver=4.12.3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=4.12.3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/uploads/cropped-cropped-Publishing-and-printing-journal-logo-1-180x180.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/uploads/cropped-cropped-Publishing-and-printing-journal-logo-1-192x192.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/uploads/cropped-cropped-Publishing-and-printing-journal-logo-1-32x32.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-includes/js/dist/hooks.min.js?ver=f0f188028580e8dc1255</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ppjournal.org/wp-includes/js/dist/i18n.min.js?ver=1dfe7db3940c23ea9216</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ppjournal.org/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ppjournal.org/wp-includes/js/jquery/jquery.min.js?ver=3.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ppjournal.org/wp-includes/js/wp-emoji-release.min.js?ver=7.1.2</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ppjournal.org/wp-json/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-json/oembed/1.0/embed</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fppjournal.org%2F</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fppjournal.org%2F&amp;format=xml</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-json/wp/v2/pages/26</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/xmlrpc.php?rsd</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.w.org/images/core/emoji/17.0.2/72x72/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://s.w.org/images/core/emoji/17.0.2/svg/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://statcounter.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.scopus.com/sourceid/21101256260</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.statcounter.com/counter/counter.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://x.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ppjournal.org#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://ppjournal.org#content</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://c.statcounter.com/t.php</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://c.statcounter.com/t.php?sc_project=13209670&amp;u1=79AB7322E8FF4047BFB316897CEF193B&amp;java=1&amp;security=46cdb541&amp;sc_snum=1&amp;sess=cdc9e8&amp;sc_rum_e_s=851&amp;sc_rum_e_e=871&amp;sc_rum_f_s=0&amp;sc_rum_f_e=842&amp;p=0&amp;pv=NaN&amp;rcat=d&amp;rdom=d&amp;rdomg=new&amp;bb=1&amp;jg=new&amp;rr=1.1.1.1.1.1.1.1.1&amp;sc_bot=1&amp;sc_bot_type=selenium&amp;resolution=800&amp;h=600&amp;camefrom=&amp;u=https%3A//ppjournal.org/&amp;t=Home%20-%20Publishing%20and%20Printing%20Journal&amp;get_config=true</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Roboto+Serif:400%2C700%2C600</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/lora/v37/0QIvMX1D_JOuMwr7Iw.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/robotoserif/v17/R70mjywflP6FLr3gZx7K8UyuXDs9zVwDmXCb8lxYgmuii32UGoVldX6UgfjL4-3sMM_kB_qXSEX5KSh0.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/about/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/archives/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/call-for-papers/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/contact-us/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/editorial-board/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/guidelines/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/volume-7-issue-10-2026/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.5</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.5</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.5</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/themes/astra/assets/css/minified/compatibility/contact-form-7-main.min.css?ver=4.12.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.12.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/themes/astra/assets/js/minified/flexibility.min.js?ver=4.12.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=4.12.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/uploads/01-scopus-blog-orange-300x47.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/uploads/Screenshot-2026-03-07-113930.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-content/uploads/cropped-cropped-Publishing-and-printing-journal-logo-1-32x32.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-includes/js/dist/hooks.min.js?ver=f0f188028580e8dc1255</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-includes/js/dist/i18n.min.js?ver=1dfe7db3940c23ea9216</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-includes/js/jquery/jquery.min.js?ver=3.7.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ppjournal.org/wp-includes/js/wp-emoji-release.min.js?ver=7.1.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://statcounter.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.scopus.com/sourceid/21101256260</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.statcounter.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.statcounter.com/counter/counter.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:submit@ppjournal.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>1.1.1.1</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ppjournal.org/&amp;t=Home</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>c.statcounter.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ppjournal.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>statcounter.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.scopus.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.statcounter.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>gmpg.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ppjournal.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>s.w.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>statcounter.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.scopus.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>x.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>203.22.241.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>172.66.169.241</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>188.114.96.3</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>66.155.40.24</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.0.77.48</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>188.114.96.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.20.23.96</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>162.159.140.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>5a7225cbf2528b11d26fb10d70434bc1b19ee1013f562fe6bf4640de72cfcc4f</SHA-256>
              <SHA-1>9bc292f37f8c265911d21e38c83e99757346d734</SHA-1>
              <MD5>18e0f3256bd409e0d70e46446e4de238</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>85c1db2701c9f3a716fefa9ff383051ede90141a32884b8d849b223fb38f7d30</SHA-256>
              <SHA-1>6db68fb596801eab91aeaf64ac5f5c184831ba93</SHA-1>
              <MD5>821f1ce393875d9a51b7a5d6ea33dc88</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>853b45ded2016a0c1daff5e392ec51adfe48018c16009d09bc2f3a25ba353e11</SHA-256>
              <SHA-1>b531b3453c28c1640dcce64418040e296e25300b</SHA-1>
              <MD5>977d849a8dfbc7661c64db4eb36065c2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>4a019ce9b35f78b7737b62c1c57eb5104482be35a50b6790d2c64cf2622c090f</SHA-256>
              <SHA-1>87898e56440109c2beba9834bb69fae0f75714df</SHA-1>
              <MD5>5ddeb0922dd2b3181137f676d32e7b2f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>23805af0c8b88f5072e05264b97efc4d33a06128c4d6049bc607cd94b6e2f99a</SHA-256>
              <SHA-1>486031bcd3a9932bdaca47bed9c866a66cd7c8cd</SHA-1>
              <MD5>3f4a5d83c9096ba42d7c30c1fd91a04a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>676040d699430d451609313f0fe8f272313eb6f642589bdb93c6975fadbf2a20</SHA-256>
              <SHA-1>e585e191890808c7a52913b8bb994032637cc863</SHA-1>
              <MD5>3133f99800e9e421d47a95899ecb6d74</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>0d037d0ac35111285f00289e1a929e539c278d4d47847b8e8059793d4ba0908a</SHA-256>
              <SHA-1>927331f261aa900ba4de828e75d2f6c3b786bcb2</SHA-1>
              <MD5>f90520ce8a94803be7864ed7ee493c24</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>2f974b3ccdf5ca7e53e242c838edc2a4602a0ee0eebedb727696188b935b6686</SHA-256>
              <SHA-1>f0b95f92abacc3290fda6793dfe46acef7fbcab3</SHA-1>
              <MD5>93aabba4db249dc4d5b3c688934ae345</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3</SHA-256>
              <SHA-1>c90b1ed149a278c322a63f3a79443ccce5592382</SHA-1>
              <MD5>7dcb0bb1f67bc5cd9aa86bc0577108e3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxp://ppjournal.org</name>
        <report_id>9c2eab62-e4a8-413e-855e-2279a86a033f</report_id>
        <tags>
          <value>html</value>
          <value>javascript</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>2ea72a4e649451a452fc7fe679c9fc273735e2e444e201424e8c6ece84e56253</id>
    <title>Analysis Report for 2ea72a4e649451a452fc7fe679c9fc273735e2e444e201424e8c6ece84e56253</title>
    <updated>2026-10-05T12:10:22Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac393e7d130e7ad452676cc</_id>
        <file_type>text/x-shellscript</file_type>
        <flow_id>6ac393adedc8b0d17b002879</flow_id>
        <hash>2ea72a4e649451a452fc7fe679c9fc273735e2e444e201424e8c6ece84e56253</hash>
        <iocs/>
        <name>ovpn.sh</name>
        <report_id>9ffd69f4-65c0-4dc8-9665-236f7a49ec30</report_id>
        <tags>
          <value>shell</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>72c4e0c1830b371971f1b06c49829b4f92548fbee1c2f6b9f32039938da258c1</id>
    <title>Analysis Report for 72c4e0c1830b371971f1b06c49829b4f92548fbee1c2f6b9f32039938da258c1</title>
    <updated>2026-10-05T12:09:00Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac393a3d130e7ad452676b7</_id>
        <file_type>text/x-shellscript</file_type>
        <flow_id>6ac3935cddbdd2f79346b2fb</flow_id>
        <hash>72c4e0c1830b371971f1b06c49829b4f92548fbee1c2f6b9f32039938da258c1</hash>
        <iocs/>
        <name>vpn-core.sh</name>
        <report_id>dea95d27-fc31-488d-89b4-7074a6107044</report_id>
        <tags>
          <value>shell</value>
          <value>expand</value>
          <value>lolbin</value>
        </tags>
        <verdict>UNKNOWN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9eaabf6181d95ecd4b0a2f93652fb5df9a57dcc71f0708408c64416c48a5b8b4</id>
    <title>Analysis Report for 9eaabf6181d95ecd4b0a2f93652fb5df9a57dcc71f0708408c64416c48a5b8b4</title>
    <updated>2026-10-05T12:08:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39398d130e7ad452676b0</_id>
        <file_type>image/png</file_type>
        <flow_id>6ac39331edc8b0d17b002672</flow_id>
        <hash>9eaabf6181d95ecd4b0a2f93652fb5df9a57dcc71f0708408c64416c48a5b8b4</hash>
        <iocs/>
        <name>world1.png</name>
        <report_id>fe832e81-47c6-4a2a-ab3e-59c45422a9c1</report_id>
        <tags>
          <value>png</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>04b6cea42fa409e2a69a3a1f489b4b33314af7d3e7e95c35bfe52021193de930</id>
    <title>Analysis Report for 04b6cea42fa409e2a69a3a1f489b4b33314af7d3e7e95c35bfe52021193de930</title>
    <updated>2026-10-05T12:08:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39375d130e7ad4526769e</_id>
        <file_type>application/json</file_type>
        <flow_id>6ac39331edc8b0d17b002672</flow_id>
        <hash>04b6cea42fa409e2a69a3a1f489b4b33314af7d3e7e95c35bfe52021193de930</hash>
        <iocs/>
        <name>pack.mcmeta</name>
        <report_id>60e9dbe8-3df3-4e53-9035-c1fe2867f3e6</report_id>
        <tags>
          <value>json</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9f424b57ed3f7736e5955a0672f60b925d2a76d44174677155552afad6f53e49</id>
    <title>Analysis Report for 9f424b57ed3f7736e5955a0672f60b925d2a76d44174677155552afad6f53e49</title>
    <updated>2026-10-05T12:08:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39377d130e7ad452676a0</_id>
        <file_type>image/png</file_type>
        <flow_id>6ac39331edc8b0d17b002672</flow_id>
        <hash>9f424b57ed3f7736e5955a0672f60b925d2a76d44174677155552afad6f53e49</hash>
        <iocs/>
        <name>world0.png</name>
        <report_id>bd7febd8-6e30-4cc9-b2fb-020f6b3c1611</report_id>
        <tags>
          <value>png</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d65165279105ca6773180500688df4bdc69a2c7b771752f0a46ef120b7fd8ec3</id>
    <title>Analysis Report for d65165279105ca6773180500688df4bdc69a2c7b771752f0a46ef120b7fd8ec3</title>
    <updated>2026-10-05T12:08:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39378d130e7ad452676a1</_id>
        <file_type>application/octet-stream</file_type>
        <flow_id>6ac39331edc8b0d17b002672</flow_id>
        <hash>d65165279105ca6773180500688df4bdc69a2c7b771752f0a46ef120b7fd8ec3</hash>
        <iocs/>
        <name>.DS_Store</name>
        <report_id>07ebd388-9d09-4b33-8c7b-e87cbe53f566</report_id>
        <tags>
          <value>data</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>b0bd25a3318cd9f44a887a85c2268ecee80384392beeff1c5e4b6b7dbc4d8965</id>
    <title>Analysis Report for b0bd25a3318cd9f44a887a85c2268ecee80384392beeff1c5e4b6b7dbc4d8965</title>
    <updated>2026-10-05T12:08:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39397d130e7ad452676ae</_id>
        <file_type>image/png</file_type>
        <flow_id>6ac39331edc8b0d17b002672</flow_id>
        <hash>b0bd25a3318cd9f44a887a85c2268ecee80384392beeff1c5e4b6b7dbc4d8965</hash>
        <iocs/>
        <name>pack.png</name>
        <report_id>e7f1af52-f96c-4d9f-8715-cf3967ea1ddf</report_id>
        <tags>
          <value>png</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>7d227e315bf400ea12bbea5f0efcdf31ee9b3259b47f6f22fd56c854bf6e15ae</id>
    <title>Analysis Report for 7d227e315bf400ea12bbea5f0efcdf31ee9b3259b47f6f22fd56c854bf6e15ae</title>
    <updated>2026-10-05T12:08:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3939fd130e7ad452676b5</_id>
        <file_type>application/x-tika-msoffice</file_type>
        <flow_id>6ac39331edc8b0d17b002672</flow_id>
        <hash>7d227e315bf400ea12bbea5f0efcdf31ee9b3259b47f6f22fd56c854bf6e15ae</hash>
        <iocs/>
        <name>Thumbs.db</name>
        <report_id>20c483b3-af09-45c4-a2f3-e40e590c58f4</report_id>
        <tags>
          <value>ole</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d5b933f361a12a29d4425fee730a51b70d79ff74e1fbc8ef1a1aa8e1f56acba0</id>
    <title>Analysis Report for d5b933f361a12a29d4425fee730a51b70d79ff74e1fbc8ef1a1aa8e1f56acba0</title>
    <updated>2026-10-05T12:08:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac393a5d130e7ad452676b9</_id>
        <file_type>application/x-tika-msoffice</file_type>
        <flow_id>6ac39331edc8b0d17b002672</flow_id>
        <hash>d5b933f361a12a29d4425fee730a51b70d79ff74e1fbc8ef1a1aa8e1f56acba0</hash>
        <iocs/>
        <name>Thumbs.db</name>
        <report_id>6106ffb3-0265-40ca-890d-e24d88253ff2</report_id>
        <tags>
          <value>ole</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f8a8511a1b70ac5febee2c3693b97ff8722fe68f5f264afd8dd7973ea0495107</id>
    <title>Analysis Report for f8a8511a1b70ac5febee2c3693b97ff8722fe68f5f264afd8dd7973ea0495107</title>
    <updated>2026-10-05T12:08:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3937fd130e7ad452676a6</_id>
        <file_type>application/x-tika-msoffice</file_type>
        <flow_id>6ac39331edc8b0d17b002672</flow_id>
        <hash>f8a8511a1b70ac5febee2c3693b97ff8722fe68f5f264afd8dd7973ea0495107</hash>
        <iocs/>
        <name>Thumbs.db</name>
        <report_id>5312ab67-2475-4256-9be3-fc31a30a9439</report_id>
        <tags>
          <value>ole</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>5193cac81ac35d97c4e1644724c39cebf9b58851dd9b69c7176d7bc5cd0453a1</id>
    <title>Analysis Report for 5193cac81ac35d97c4e1644724c39cebf9b58851dd9b69c7176d7bc5cd0453a1</title>
    <updated>2026-10-05T12:07:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac393a1d130e7ad452676b6</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac392f8766af099f2b3ab17</flow_id>
        <hash>5193cac81ac35d97c4e1644724c39cebf9b58851dd9b69c7176d7bc5cd0453a1</hash>
        <iocs>
          <urls>
            <value>
              <url>http://www.firsteclinical.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://firsteclinical.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://www.facebook.com/profile.php?id=61576994112852</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.godaddy.com/websites/website-builder?isc=pwugc&amp;utm_source=wsb&amp;utm_medium=applications&amp;utm_campaign=en-us_corp_applications_base</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/first-e-clinical/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>firsteclinical.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.godaddy.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>Firsteclinical@gmail.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>Info@firsteclinical.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>typesetit@att.net</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>104.18.41.41</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>13.248.243.5</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.52.180.13</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>57.144.244.1</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>8acd3fc7ce8dfa2a3b86ec1d8e48a26f6dc78553f7912722065dafba5af79f46</SHA-256>
              <SHA-1>655d72587c7c8206edb3d06a45007a56466235e4</SHA-1>
              <MD5>750c4dad894fcfa7d62300cd2ec4d226</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>5193cac81ac35d97c4e1644724c39cebf9b58851dd9b69c7176d7bc5cd0453a1</SHA-256>
              <SHA-1>9d814a2d451d73ba7dd4c4984c1d0e3f5ffc72e2</SHA-1>
              <MD5>8cc47cbc9b8735289d3445ac8614fce2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>4d0c81db97e5070f4321835b57d62f93f4d743fa4660cd1cbfe3365d66db73bb</SHA-256>
              <SHA-1>8327a9bf92888418b4a97a83c7702f906f28619d</SHA-1>
              <MD5>414faa36fe28cdb5687abc4c76c2ba19</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>8128b084ad374cbfbf72d8cae91fd717b0165164929ce1a735458bcdd2f7d6b4</SHA-256>
              <SHA-1>3d01694e62a1c0b51380ceb3bdf08e41e63df8f3</SHA-1>
              <MD5>cfc67121556fff106bc3cd90c519cdb0</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>21978b4c-dce8-4767-8e10-3dd9186c6dca</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>21a39536-0151-43b3-87d7-bbf7d12ae179</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>23169a70-8d45-45f3-9797-6857c1341ce7</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>2fdb1ff9-931c-4b8a-9da2-f6a108475411</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>3eb7dcce-7b12-4ea5-a82c-9bb5cdae5423</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4b78c294-5de8-4030-9181-357d4d94e46a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>5d760300-3cd4-40a4-a247-1553d6dbc748</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>6e3401fb-aed3-4f9f-9b1a-992e6596e8de</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>b00ae9b0-39e2-4758-997c-3d4776ea9b64</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>b8f80afb-f237-4aa8-ad2f-3b06f276cfb9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>b9ab59f0-4dea-446b-9d74-d066bef107f9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>bfab2860-655f-446a-9363-63e911232764</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>bfeb5508-e7a1-455c-85b1-f7284c2947c6</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>c19c2895-3b85-42f7-abb5-a3a69a1e71a3</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>c965ff88-ce34-4779-b1b2-2d50345e6a3d</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>cebae1c5-d49d-4314-8705-3969973877a8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>cf93b1c0-ce88-4fc3-be53-55adaf8c661a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>d5919608-1d86-4ca0-97b6-4aefa572f8b3</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>f8d191c0-d86e-4a3f-ba38-d633c5ef99a5</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxp://www.firsteclinical.com/</name>
        <report_id>d0be57a1-23e4-492b-91bd-1cc00ebe83be</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>5e8bfc03ba47d1c00643f4ccb7d8b7a3dafcbb180d15248e74e095f205b922c9</id>
    <title>Analysis Report for 5e8bfc03ba47d1c00643f4ccb7d8b7a3dafcbb180d15248e74e095f205b922c9</title>
    <updated>2026-10-05T12:07:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39360d130e7ad45267696</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6ac392f1766af099f2b3aae2</flow_id>
        <hash>5e8bfc03ba47d1c00643f4ccb7d8b7a3dafcbb180d15248e74e095f205b922c9</hash>
        <iocs>
          <urls>
            <value>
              <url>http://104.168.4.206/bins.sh</url>
              <origin>INPUT_FILE</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>https://speed.cloudflare.com/__down?bytes=10000000'</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>speed.cloudflare.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>172.66.0.218</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.168.4.206</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>2aac39b80684f98d718804de17ad8c63d13ce4540bb99b12e95319dbe0d443dd</SHA-256>
              <SHA-1>7b182279a37a14d3346a055c30630c23c8d25394</SHA-1>
              <MD5>7d43c822510268387e59fcaa251a806f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>dissarm6.elf</name>
        <report_id>39a4079d-d14f-4500-bb12-fb3c4e4a2953</report_id>
        <tags>
          <value>elf</value>
          <value>txt</value>
          <value>expand</value>
          <value>lolbin</value>
          <value>gcc</value>
          <value>rust</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9087452bc57e6379534306b70943a742668f467215a55af47456c987e03ad916</id>
    <title>Analysis Report for 9087452bc57e6379534306b70943a742668f467215a55af47456c987e03ad916</title>
    <updated>2026-10-05T12:07:12Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac392f6d130e7ad45267677</_id>
        <file_type>text/x-shellscript</file_type>
        <flow_id>6ac392ee7e4998b7d618023f</flow_id>
        <hash>9087452bc57e6379534306b70943a742668f467215a55af47456c987e03ad916</hash>
        <iocs>
          <ips>
            <value>
              <ip>1.2.3.4</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
        </iocs>
        <name>wg.sh</name>
        <report_id>85e219d3-f198-42a3-8a9f-e3abea69aae3</report_id>
        <tags>
          <value>shell</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e9add71929857777c3a58b1e14735d34d352d3cfb0201884f0c2a1c19044f73d</id>
    <title>Analysis Report for e9add71929857777c3a58b1e14735d34d352d3cfb0201884f0c2a1c19044f73d</title>
    <updated>2026-10-05T12:06:53Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39358d130e7ad45267693</_id>
        <file_type>application/vnd.android.package-archive</file_type>
        <flow_id>6ac392dc4c2119a4a0856e20</flow_id>
        <hash>e9add71929857777c3a58b1e14735d34d352d3cfb0201884f0c2a1c19044f73d</hash>
        <iocs/>
        <name>Today Weather-Data by NOAA-NWS v2.5.2-2 b766 arm7+arm64 6.0 Patched by youarefinished.apk</name>
        <report_id>e2614f54-e2a3-4ddf-bd97-b314929690ac</report_id>
        <tags>
          <value>apk</value>
          <value>persistence</value>
          <value>signed</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>59edcacc2d44ee0a4fcc20d3ad883240fd6335bd34c6c2f250a733d288dc443b</id>
    <title>Analysis Report for 59edcacc2d44ee0a4fcc20d3ad883240fd6335bd34c6c2f250a733d288dc443b</title>
    <updated>2026-10-05T12:06:41Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39302d130e7ad4526767b</_id>
        <file_type>application/vnd.ms-outlook</file_type>
        <flow_id>6ac392d0edc8b0d17b002478</flow_id>
        <hash>59edcacc2d44ee0a4fcc20d3ad883240fd6335bd34c6c2f250a733d288dc443b</hash>
        <iocs>
          <urls>
            <value>
              <url>http://parcelnotification.myhermes.it-file.net/220a53d9-83d4-42a5-bbee-27fa59d1459e</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://parcelnotification.myhermes.it-file.net/220a53d9-83d4-42a5-bbee-27fa59d1459e</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://parcelnotification.myhermes.it-file.net/220a53d9-83d4-42a5-bbee-27fa59d1459e</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://parcelnotification.myhermes.it-file.net/220a53d9-83d4-42a5-bbee-27fa59d1459e</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schema.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.hornetsecurity.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>parcelnotification.myhermes.it-file.net</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>hornetsecurity.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>parcelnotification.myhermes.it-file.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schema.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>parcelnotification.myhermes.it-file.net</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>parcelnotification.myhermes.it-file.net</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>Enrico.Ambroso@volkswagengroup.it</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>NOREPLY@PARCELNOTIFICATION.MYHERMES.IT-FILE.NET</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>enrico.ambroso@volkswagengroup.it</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>extern.matthias.colognese@volkswagengroup.it</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>mail.security@volkswagengroup.itEnrico.Ambroso</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>noreply@parcelnotification.myhermes.it-file.net</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>support@hornetsecurity.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>185.88.214.116</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>10.167.240.167</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>94.100.132.73</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>94.100.132.71</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>132c6c6e97406455e99e4ace7f3cdf31c1118d2a42fe65c05ef1ec2e64850792</SHA-256>
              <SHA-1>c498e05b6313f504a9850fb96420b4ea4b3af97b</SHA-1>
              <MD5>4edd58f27a798eebc5748af6e52e4c33</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>334f1e1b43c97ee12feb0fdae8be08e194d256558dd21749342e8f1b71728447</SHA-256>
              <SHA-1>fa97fa6e7c259e8db642fbdc866619c23e6bb845</SHA-1>
              <MD5>2dbf9fc35d02a377d440133e2e741e1b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>a9c2ba026f09ad168b7642bcd48d75d2fa40fa55a7498a19a65bbb392bbe8b71</SHA-256>
              <SHA-1>c8590e74524ea486d1eebba454afcc4260ec22a0</SHA-1>
              <MD5>4dbba5cc2bc81edc3e7856366831e494</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>dbc58fa47108efceaab28ae7b922c09b138cfa61dd7205c3eb9ac99f9bb44826</SHA-256>
              <SHA-1>6e35c512e9ca576d45f077961cb7e1bba5aca396</SHA-1>
              <MD5>4b27d4fe60f2c4312c60143c6e421622</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>f8fe008dc2c54a45c40f4ebd2d42d1bffb5214ef85825a63ec4bfbf2b10fdd5c</SHA-256>
              <SHA-1>dc359945e38aaf712512e0529ffd24fcbc10583f</SHA-1>
              <MD5>7e16428aac6ea1b2d83700395a96fd3a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>b59125d72e18898379d5a051330474f6f9ed6e15474b828535deeb839364de94</SHA-256>
              <SHA-1>202d9db04af3c9a5e870beadc0f0c73b4f8fd907</SHA-1>
              <MD5>4cd36d6801de195bdddaaf30fcda67e8</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>c518e6f45fb16cc2dc83656804e33753e2b01af4f4a66943d01e29756fd931d8</SHA-256>
              <SHA-1>8f3c9098ad395ae3c024a5886fa6482bd69a4e1d</SHA-1>
              <MD5>9a36e7a8723bc444201990f27e0b5afa</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>fb2a02198ace8955cb3693e6114e34c5b230c565ca2906c244632ff6ce943e98</SHA-256>
              <SHA-1>d60fe98a96ee992726b9ab37696fe8e7b281245f</SHA-1>
              <MD5>48df93a6dfb089d8930dc8c8241a4498</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>220a53d9-83d4-42a5-bbee-27fa59d1459e</uuid>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <uuid>0f6f68be-4ef2-465a-986b-eb9a250d9789</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>220a53d9-83d4-42a5-bbee-27fa59d1459e</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>363ed4f4-6432-41b4-bd3d-25ac2b45c0a8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>72ed2a61-ba9a-40f2-94a0-f58f41eb108b</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>74bb2185-e9c7-4edc-9b0d-870fc1121db8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>be4f26e8-9dd4-4f42-ad7b-fb82199421c2</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>dfc9cb8e-228c-451f-9d4c-65e6477633ca</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e6ad5535-a168-490c-e647-08df22b1a3d8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>220a53d9-83d4-42a5-bbee-27fa59d1459e</uuid>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <uuid>220a53d9-83d4-42a5-bbee-27fa59d1459e</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>EXT La sua spedizione Hermes è in arrivo.msg</name>
        <report_id>00950448-2519-456d-9eeb-7b3f6b77f7ba</report_id>
        <tags>
          <value>msg</value>
          <value>ole</value>
          <value>html</value>
          <value>png</value>
          <value>anti-vm</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>962d3a89c42ed984f4a68c2466931e2531e434ed28fe3b712d64c9eeb9185b06</id>
    <title>Analysis Report for 962d3a89c42ed984f4a68c2466931e2531e434ed28fe3b712d64c9eeb9185b06</title>
    <updated>2026-10-05T12:06:35Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac392ead130e7ad45267673</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6ac392c9edc8b0d17b002453</flow_id>
        <hash>962d3a89c42ed984f4a68c2466931e2531e434ed28fe3b712d64c9eeb9185b06</hash>
        <iocs>
          <urls>
            <value>
              <url>http://pekora.pro</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://github.com/emilk/egui/issues</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://github.com/rust-windowing/winit</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://github.com/source-foundry</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://github.com/source-foundry/Hack/blob/master/LICENSE.md</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/source-foundry/HackThe</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://pekora.pro/bootstrapper/PekoraPlayerLauncher.exe</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://www.pekora.pro</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>github.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>pekora.pro</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>appro@openssl.org</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>140.82.121.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.67.210.94</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>2a551b191a6a8832bde787caa474b1a52fa5e818a07b12af5f28ecb23c2ac374</SHA-256>
              <SHA-1>22b9035786784511f44c56ccabc492319de80ec7</SHA-1>
              <MD5>7ed5b3fc7d811c7a75ff63513627c48c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>3f775a43bf27c55e3562b6c03b3e5e4de13591455f7510e3a7e2538c65db6029</SHA-256>
              <SHA-1>6d8864c6b74826103e61425e67decbf9697530a0</SHA-1>
              <MD5>48f75483b41fae2cb5cb38a982769482</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>9935dbb3d6b52da1253db5327d25f591a6f750e9e57e6a1d775abbef364c4a8e</SHA-256>
              <SHA-1>29789bcafb9e87ffbf03c7628f6ac5d1983387f2</SHA-1>
              <MD5>d811a3b9b9ee8c1aaff268971c74907d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>ba2f9cc4cc104a6df1d711148c357b48cba28ac1ad534015f93e23f52ba1eda7</SHA-256>
              <SHA-1>d7317b00a46830f5d1c2bfd22d98c1cae657c283</SHA-1>
              <MD5>82e99a1511db8a3fe4d859f3a2ed94e5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>bd9dda152cf01365c73f8baf5c97ec3c8d295cb5eb2f983ae709c55d39d49e17</SHA-256>
              <SHA-1>47c253eacb7f6e572304d137b443ccaa31984a38</SHA-1>
              <MD5>87b9580556509fc86d48a7ddc84fad75</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>cef37a67c2613adae364b7c847cb55717dd47e07bb04f3e4adda60853e1c80fb</SHA-256>
              <SHA-1>e162749f7a51a7056888523b86c49c767c67c8c0</SHA-1>
              <MD5>d3ede15200123b3cc5b81978692ebce0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>d74ac40a6d77debd676aac32664f4b8685b3fa9b62e5633120c2c3b4426c7a06</SHA-256>
              <SHA-1>8afda57f8f5552586832e01cd3a082327b08dec1</SHA-1>
              <MD5>f12d13160197548953cb1486ff030fe0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>f9bbaa51b2ca6d168544fed62bc923f8f7c3f5b61151a57ba8d933430f51468c</SHA-256>
              <SHA-1>6e17eddcaed267f4a4c0ce1c51b4acc7a6eb68d6</SHA-1>
              <MD5>2e87863f42ab5c57c5de2c7f8295de74</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>56c4a72d16574c0396b9be192a11be5a36dae20d9539346f212584a1a16c1629</SHA-256>
              <SHA-1>5c22d6cede4a071103c20be13b4c8823ad1e2b29</SHA-1>
              <MD5>ac11e57231b3744d66db244e98c498f8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>e9276573fbcabc44748de3a699c2ceebf3d7ff73af9aa633cfb8ff3222345e08</SHA-256>
              <SHA-1>cc25b5f5f6e6ca707484e55bdb689ba109fc8d5f</SHA-1>
              <MD5>a56c49bcc00c6d6c46af3e29a6b9cc14</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>0943fec9db4c530c80bd1d57c2fd5d2bf0f9094702716e752309d9f4267bf89c</SHA-256>
              <SHA-1>6474deb77696812f3fb5fd93a7fe40e5e8bec6df</SHA-1>
              <MD5>b698f6159a18ec1b57774e76194d4a04</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>f9ff233e6e6995ece2aa40c82c247dcdbcc5e8db305454ae6c739e173c3eb76c</SHA-256>
              <SHA-1>c07b11ac6d2727325d96608e5d43dbe71a647bd8</SHA-1>
              <MD5>a45e49af1be686f241f1487ee3ccf785</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>0c849d29bfb34f19e1a7e2fe18a8e2297b1c6b8823a7e76f7395a8990c5bb679</SHA-256>
              <SHA-1>ab580e6abd1ce48ff02c52c201056bdff828e555</SHA-1>
              <MD5>117678005aa552875664bca45dbc74a9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <registry>
            <value>
              <registry>Software\Classes\</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Classes\.</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>hxxps://pekora.pro/bootstrapper/PekoraPlayerLauncher.exe</name>
        <report_id>55ac8def-2d03-4149-ac1d-50f13373a998</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>keylogger</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>rust</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>72c4e0c1830b371971f1b06c49829b4f92548fbee1c2f6b9f32039938da258c1</id>
    <title>Analysis Report for 72c4e0c1830b371971f1b06c49829b4f92548fbee1c2f6b9f32039938da258c1</title>
    <updated>2026-10-05T12:06:14Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac392bdd130e7ad45267666</_id>
        <file_type>text/x-shellscript</file_type>
        <flow_id>6ac392b5edc8b0d17b0023cd</flow_id>
        <hash>72c4e0c1830b371971f1b06c49829b4f92548fbee1c2f6b9f32039938da258c1</hash>
        <iocs/>
        <name>vpn-core.sh</name>
        <report_id>b3785a96-8235-4a8c-bbda-f4227b9573c5</report_id>
        <tags>
          <value>shell</value>
          <value>expand</value>
          <value>lolbin</value>
        </tags>
        <verdict>UNKNOWN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>b4614ad233a4ac69f1d4e5623ccc4c22ef2d2025af8529936a7975b8c347e969</id>
    <title>Analysis Report for b4614ad233a4ac69f1d4e5623ccc4c22ef2d2025af8529936a7975b8c347e969</title>
    <updated>2026-10-05T12:04:25Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3929dd130e7ad4526765c</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39248766af099f2b3a8af</flow_id>
        <hash>b4614ad233a4ac69f1d4e5623ccc4c22ef2d2025af8529936a7975b8c347e969</hash>
        <iocs>
          <urls>
            <value>
              <url>63.177.146.192</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/howyoutubeworks?utm_source=ythp&amp;utm_medium=LeftNav&amp;utm_campaign=ytgen</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/signin?action_handle_signin=true&amp;app=desktop&amp;hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/signin?action_handle_signin=true&amp;app=desktop&amp;hl=en&amp;next=%2Fsignin_passive&amp;feature=passive&amp;hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/signin?action_handle_signin=true&amp;app=desktop&amp;hl=en&amp;next=%2Fwatch%3Fv%3DNCh3rdJ-gEU%26list%3DRDNCh3rdJ-gEU</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/signin?action_handle_signin=true&amp;app=desktop&amp;hl=en&amp;next=%2Fwatch%3Fv%3DNCh3rdJ-gEU%26list%3DRDNCh3rdJ-gEU%26start_radio%3D1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/signin?action_handle_signin=true&amp;app=desktop&amp;hl=en&amp;next=%2Fwatch%3Fv%3DNCh3rdJ-gEU%26list%3DRDNCh3rdJ-gEU&amp;continue_action=QUZZTVljRnZyMzJpZm5NNzZwOGlLLWs1bkM3VHxBTl9pYzRmOXlYUndzRWk4NEwwOGpDMEdnaHpYaXBIQ1doNkg3UjJzV09iM3QtNjgyQ2VkdF9zWXhqejQ5OGhvSnJiSHBqSHdwaEtRTzMzOEUzWHlIR2UtUnhxTUVXTHRhMXMwX2hYbnF0SWVTbjROWjZPV2N5TkdRazJSaW9XX0pUbUI2NjBuZ0hJNVRhellBeTVlS25abThfMFVsNTQ5X0ZjMlc3LWxDQ0p5blBzWFBQOXphMVVZM0ZF</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/signin?action_handle_signin=true&amp;app=desktop&amp;hl=en&amp;next=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DNCh3rdJ-gEU%26list%3DRDNCh3rdJ-gEU%26start_radio%3D1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/signin?action_handle_signin=true&amp;app=desktop&amp;hl=en&amp;next=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DNCh3rdJ-gEU%26list%3DRDNCh3rdJ-gEU%26start_radio%3D1&amp;feature=__FEATURE__</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/watch?v=NCh3rdJ-gEU&amp;list=RDNCh3rdJ-gEU&amp;start_radio=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/watch?v=NCh3rdJ-gEU&amp;list=RDNCh3rdJ-gEU&amp;start_radio=1&amp;cbrd=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.youtube.com/watch?v=NCh3rdJ-gEU%5Cu0026list=RDNCh3rdJ-gEU</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://accountlinking-pa-clients6.youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?service%5Cu003dyoutube%5Cu0026uilel%5Cu003d3%5Cu0026passive%5Cu003dtrue%5Cu0026continue%5Cu003dhttps%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Fwatch%253Fv%253DNCh3rdJ-gEU%2526list%253DRDNCh3rdJ-gEU%2526start_radio%253D1%26feature%3D__FEATURE__%5Cu0026hl%5Cu003den</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?service=youtube%5Cu0026uilel=3%5Cu0026passive=true%5Cu0026continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fwatch%253Fv%253DNCh3rdJ-gEU%2526list%253DRDNCh3rdJ-gEU%2526start_radio%253D1%5Cu0026hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?service=youtube%5Cu0026uilel=3%5Cu0026passive=true%5Cu0026continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fwatch%253Fv%253DNCh3rdJ-gEU%2526list%253DRDNCh3rdJ-gEU%26continue_action%3DQUZZTVljRnZyMzJpZm5NNzZwOGlLLWs1bkM3VHxBTl9pYzRmOXlYUndzRWk4NEwwOGpDMEdnaHpYaXBIQ1doNkg3UjJzV09iM3QtNjgyQ2VkdF9zWXhqejQ5OGhvSnJiSHBqSHdwaEtRTzMzOEUzWHlIR2UtUnhxTUVXTHRhMXMwX2hYbnF0SWVTbjROWjZPV2N5TkdRazJSaW9XX0pUbUI2NjBuZ0hJNVRhellBeTVlS25abThfMFVsNTQ5X0ZjMlc3LWxDQ0p5blBzWFBQOXphMVVZM0ZF%5Cu0026hl=en%5Cu0026ec=66429</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?service=youtube%5Cu0026uilel=3%5Cu0026passive=true%5Cu0026continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fwatch%253Fv%253DNCh3rdJ-gEU%2526list%253DRDNCh3rdJ-gEU%5Cu0026hl=en%5Cu0026ec=66427</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?service=youtube%5Cu0026uilel=3%5Cu0026passive=true%5Cu0026continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Fwatch%253Fv%253DNCh3rdJ-gEU%2526list%253DRDNCh3rdJ-gEU%2526start_radio%253D1%5Cu0026hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?service=youtube%5Cu0026uilel=3%5Cu0026passive=true%5Cu0026continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Fwatch%253Fv%253DNCh3rdJ-gEU%2526list%253DRDNCh3rdJ-gEU%2526start_radio%253D1%5Cu0026hl=en%5Cu0026ec=65620</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?service=youtube%5Cu0026uilel=3%5Cu0026passive=true%5Cu0026continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%5Cu0026hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?service=youtube%5Cu0026uilel=3%5Cu0026passive=true%5Cu0026continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%5Cu0026hl=en%5Cu0026ec=66425</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?service=youtube%5Cu0026uilel=3%5Cu0026passive=true%5Cu0026continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%5Cu0026hl=en%5Cu0026ec=66426</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?service=youtube&amp;uilel=3&amp;passive=true&amp;continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&amp;hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://apis.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://client-channel.google.com/client-channel/client</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://clients4.google.com/invalidation/lcs/client</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://consent.youtube.com/d</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://consent.youtube.com/d?continue=https://www.youtube.com/watch%3Fv%3DNCh3rdJ-gEU%26list%3DRDNCh3rdJ-gEU%26start_radio%3D1%26cbrd%3D1%5Cu0026gl=DE%5Cu0026m=0%5Cu0026pc=yt%5Cu0026uxe=bip%5Cu0026cm=2%5Cu0026hl=en%5Cu0026src=2%5Cu0026escs=ATu9isFvF942AtolKov0YNJdPih0aFAB3WbgWna-IQk5bnb_z6Cuqx-gflQz2KXVaY7YFUFyUbCNr9bAh0tkU2XgHiJ4asYbgxoW</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://consent.youtube.com/save</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://consent.youtube.com/save?continue=https://www.youtube.com/watch%3Fv%3DNCh3rdJ-gEU%26list%3DRDNCh3rdJ-gEU%26start_radio%3D1%5Cu0026gl=DE%5Cu0026m=0%5Cu0026pc=yt%5Cu0026x=5%5Cu0026src=2%5Cu0026hl=en%5Cu0026bl=992590010%5Cu0026cm=2%5Cu0026set_eom=false%5Cu0026set_apyt=true%5Cu0026set_ytc=true%5Cu0026escs=ATu9isE36hearTAgHHDeAiX7Wp0EvjImetB5Dgg6efvWXw7eFkYVXCP35AjBktJDGiWYX657CmNfQAP2mQbTT5F1DWid-It-8Du1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://consent.youtube.com/save?continue=https://www.youtube.com/watch%3Fv%3DNCh3rdJ-gEU%26list%3DRDNCh3rdJ-gEU%26start_radio%3D1%5Cu0026gl=DE%5Cu0026m=0%5Cu0026pc=yt%5Cu0026x=5%5Cu0026src=2%5Cu0026hl=en%5Cu0026bl=992590010%5Cu0026cm=2%5Cu0026set_eom=true%5Cu0026escs=ATu9isFvoTS7HZu6VdkZCt8CTtBN2zeSizyJMpzogO2ECsBiXpLhOFFTeloO36XkLvRzPpPkGZNYNIbm1ifJwFUE5u6ksLss6Ow_</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://developers.google.com/youtube</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://families.google.com/webcreation?usegapi%5Cu003d1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://i.ytimg.com/generate_204</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/05y7buJ1NOk/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG%5Cu0026rs=AOn4CLBuYfhuu1pUNgZbNxSyuAVi7buALA</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/05y7buJ1NOk/hqdefault.jpg?sqp=-oaymwEcCNACELwBSFXyq4qpAw4IARUAAIhCGAFwAcABBg==%5Cu0026rs=AOn4CLASCpjCbUnRmLI20wLsROZTdjw5LA</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/05y7buJ1NOk/hqdefault.jpg?sqp=-oaymwEwCKgBEF5IWvKriqkDIwgBFQAAiEIYAfABAfgBtgiAArgIigIMCAAQARhyIFYoPTAP%5Cu0026rs=AOn4CLDTuS24RGrPI-Rr-oF34nro7lapcA</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/05y7buJ1NOk/hqdefault.jpg?sqp=-oaymwExCNACELwBSFryq4qpAyMIARUAAIhCGAHwAQH4AbYIgAK4CIoCDAgAEAEYciBWKD0wDw==%5Cu0026rs=AOn4CLCJsuGCLD0_Avamzje-UFlrnw3Y8w</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/7osq8TLaKv0/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG%5Cu0026rs=AOn4CLBzyFcj_q3EXMtiQzRXkIPoAejO-A</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/7osq8TLaKv0/hqdefault.jpg?sqp=-oaymwEcCNACELwBSFXyq4qpAw4IARUAAIhCGAFwAcABBg==%5Cu0026rs=AOn4CLCmy-lkN6dufK5NgWlDM2UFDqooMg</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/C3UsZVXmQ8Y/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG%5Cu0026rs=AOn4CLCei70Ui5-tv98zFEqdBVEAZJJbaQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/C3UsZVXmQ8Y/hqdefault.jpg?sqp=-oaymwEcCNACELwBSFXyq4qpAw4IARUAAIhCGAFwAcABBg==%5Cu0026rs=AOn4CLCm9V1KGNa7Jp8TcLvOMU-8ZMR-9w</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/HropgeYirpE/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG%5Cu0026rs=AOn4CLDLAyPq61VInNEXIohrUdkrQVxG4g</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/HropgeYirpE/hqdefault.jpg?sqp=-oaymwEcCNACELwBSFXyq4qpAw4IARUAAIhCGAFwAcABBg==%5Cu0026rs=AOn4CLB4GcN3ItmT05aR3VT1nPKJbdwm5Q</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/KpvZmwEB4Eg/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG%5Cu0026rs=AOn4CLDKqgmjZ4B8JFvLWq37bWDeXlbz3g</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/KpvZmwEB4Eg/hqdefault.jpg?sqp=-oaymwEcCNACELwBSFXyq4qpAw4IARUAAIhCGAFwAcABBg==%5Cu0026rs=AOn4CLAI3JiOBMU3iu7J_P82lEj3Z78HIA</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/KtOeap2K9bM/hqdefault.jpg?sqp=-oaymwE1CKgBEF5IVfKriqkDKAgBFQAAiEIYAXABwAEG8AEB-AH-CYAC0AWKAgwIABABGH8gFSgVMA8=%5Cu0026rs=AOn4CLA_EskZ3OpZCymiX6i26jJwceo8pQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/KtOeap2K9bM/hqdefault.jpg?sqp=-oaymwE2CNACELwBSFXyq4qpAygIARUAAIhCGAFwAcABBvABAfgB_gmAAtAFigIMCAAQARh_IBUoFTAP%5Cu0026rs=AOn4CLBvEAOoJ9z8JjAXDGXVXkXSgqHL4g</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/MNEiImMidW0/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG%5Cu0026rs=AOn4CLDPcc9hiJaNz2TeNfE80ChjMaFOrA</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/MNEiImMidW0/hqdefault.jpg?sqp=-oaymwEcCNACELwBSFXyq4qpAw4IARUAAIhCGAFwAcABBg==%5Cu0026rs=AOn4CLAiFkUTa-shKsH_VwiLpMBnZ-7Ngg</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/MzcWuTFqjBU/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG%5Cu0026rs=AOn4CLCGJNI52Li-FwIUVr6NG5IxvLKAaA</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/NCh3rdJ-gEU/hqdefault.jpg</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/UJnZ0SjU1jA/hqdefault.jpg?sqp=-oaymwE1CKgBEF5IVfKriqkDKAgBFQAAiEIYAXABwAEG8AEB-AHOBYACgAqKAgwIABABGGogaihqMA8=%5Cu0026rs=AOn4CLATLbxL8s2Fz8zF_g1UVxMponbWhA</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/UJnZ0SjU1jA/hqdefault.jpg?sqp=-oaymwE2CNACELwBSFXyq4qpAygIARUAAIhCGAFwAcABBvABAfgBzgWAAoAKigIMCAAQARhqIGooajAP%5Cu0026rs=AOn4CLC_sqFeIPeF3HNd4ASJT7jZ-6QbZA</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/dWWP8Tcnezk/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG%5Cu0026rs=AOn4CLCvPH8iizAjG4phGjWjJGM2CmyZ_Q</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/dWWP8Tcnezk/hqdefault.jpg?sqp=-oaymwEcCNACELwBSFXyq4qpAw4IARUAAIhCGAFwAcABBg==%5Cu0026rs=AOn4CLB0ZKxIt0FDQo18zSid7XIrsxE0Qg</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/smSFhPUL4F4/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG%5Cu0026rs=AOn4CLBUCCwBYtQpo96OnwCTfOrTrtIDxg</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/smSFhPUL4F4/hqdefault.jpg?sqp=-oaymwEcCNACELwBSFXyq4qpAw4IARUAAIhCGAFwAcABBg==%5Cu0026rs=AOn4CLAkp7kaT8ny7RDuR2pQ_MHbPADh9A</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/vFwj9ajn0P4/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG%5Cu0026rs=AOn4CLCBKnja19QujHdG1ittCcA2-JjYdQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/vFwj9ajn0P4/hqdefault.jpg?sqp=-oaymwEcCNACELwBSFXyq4qpAw4IARUAAIhCGAFwAcABBg==%5Cu0026rs=AOn4CLC7DCR5_jMDyFtZSq1fzdkBCBb72A</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/wvwn-Ntwx58/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG%5Cu0026rs=AOn4CLD639rsbrQxequzhEbWu-GydU09dg</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ytimg.com/vi/wvwn-Ntwx58/hqdefault.jpg?sqp=-oaymwEcCNACELwBSFXyq4qpAw4IARUAAIhCGAFwAcABBg==%5Cu0026rs=AOn4CLCYB-WrY9Hfvoo2dGAOLO-HE6fdiw</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://m.youtube.com/watch?v=NCh3rdJ-gEU&amp;list=RDNCh3rdJ-gEU</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://payments.youtube.com/payments/v4/js/integrator.js?ss%5Cu003dmd</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://policies.google.com/technologies/cookies?hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://policies.google.com/terms?hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://rr1---sn-4g5e6nss.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr1---sn-4g5e6nss.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=acf999b9c3bbeec8%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://rr1---sn-4g5edndl.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr1---sn-4g5edndl.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=f33c4764e9031ce4%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://rr1---sn-4g5edndy.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr1---sn-4g5edndy.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=b3d5d6d2d965c784%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://rr1---sn-4g5ednkd.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr1---sn-4g5ednkd.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=ed2ab450f4bb6b9a%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://rr1---sn-4g5ednre.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr1---sn-4g5ednre.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=30d122226322756d%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://rr1---sn-4g5lznl7.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr1---sn-4g5lznl7.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=1ee05863e87eda62%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://rr1---sn-4g5lznld.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr1---sn-4g5lznld.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=3ea06713aef46781%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://rr1---sn-u14g55-cj.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr1---sn-u14g55-cj.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=546a6e160f0d2a70%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://rr1---sn-u14g55-jq.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr1---sn-u14g55-jq.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=c2fc27f8db70c79f%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://rr2---sn-4g5ednde.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-4g5ednde.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=53f2efecf79d0485%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://rr2---sn-4g5ednde.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=6f4a5957210d261b%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://rr2---sn-4g5edndr.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-4g5edndr.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=bb569a6d492975b5%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://rr2---sn-4g5ednk6.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-4g5ednk6.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=1eba2981e622ae91%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-4g5ednre.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-4g5ednre.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=2a9bd99b0101e048%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-4g5ednrl.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-4g5ednrl.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=ec00df48a3881f4d%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-4g5ednrz.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-4g5ednrz.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=1723a458de3e72cb%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-4g5ednsr.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-4g5ednsr.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=5099d9d128d4d630%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-4g5lznl7.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-4g5lznl7.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=4e9fe3d29bbd49c4%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-4g5lznld.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-4g5lznld.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=b2648584f50be05e%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-4g5lznld.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=d39cbb6ee27534e9%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-4g5lznld.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=f1262166399edf99%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-aj4g55-5v.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-aj4g55-5v.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=333716b9316a8c15%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-aj4g55-5w.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-aj4g55-5w.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=906d05c93dc9e9a7%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-aj4g55-j5.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-aj4g55-j5.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=0a475a7b2d6bf44e%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-aj4g55-j5.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=ee8b2af132da2afd%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-u14g55-5c.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-u14g55-5c.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=a28ecaed7a9c77e0%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-u14g55-jq.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr2---sn-u14g55-jq.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=84f6ccbc79a0b97d%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr3---sn-4g5edndy.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr3---sn-4g5edndy.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=a5c870bc0b377cbd%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr3---sn-4g5ednsr.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr3---sn-4g5ednsr.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=ca2f0ad103f6321a%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr3---sn-4g5lznl7.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr3---sn-4g5lznl7.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=7f802998f738838f%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr3---sn-4g5lznss.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr3---sn-4g5lznss.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=bc5c23f5a8e7d0fe%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr4---sn-4g5ednrs.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr4---sn-4g5ednrs.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=75658ff137277b39%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr4---sn-4g5edns6.c.youtube.com/generate_204</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr4---sn-4g5edns6.googlevideo.com/generate_204</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr4---sn-4g5edns6.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr4---sn-4g5edns6.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=342877add27e8045%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr4---sn-4g5lzner.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr4---sn-4g5lzner.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=a711c13b116b0a8c%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr4---sn-4g5lznse.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr4---sn-4g5lznse.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=bf55f3daea56a074%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr4---sn-u14g55-cw.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr4---sn-u14g55-cw.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=703ab09256a3ab45%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr5---sn-4g5e6ns7.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr5---sn-4g5e6ns7.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=e653935177f9928b%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr5---sn-4g5e6nze.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr5---sn-4g5e6nze.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=2ad39e6a9d8af5b3%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr5---sn-4g5lznek.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr5---sn-4g5lznek.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=1099a7f91c3669b5%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr5---sn-4g5lznly.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr5---sn-4g5lznly.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=0b752c6555e643c6%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr5---sn-4g5lzns7.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr5---sn-4g5lzns7.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=f537228a3f34f861%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr5---sn-aj4g55-5t.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr5---sn-aj4g55-5t.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=705afcd4caa84cac%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1388250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr5---sn-u14g55-5c.googlevideo.com/initplayback</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://rr5---sn-u14g55-5c.googlevideo.com/initplayback?source=youtube%5Cu0026oeis=1%5Cu0026c=WEB%5Cu0026oad=3200%5Cu0026ovd=3200%5Cu0026oaad=11000%5Cu0026oavd=11000%5Cu0026ocs=700%5Cu0026oewis=1%5Cu0026oputc=1%5Cu0026oehoh5=1%5Cu0026msp=1%5Cu0026odepv=1%5Cu0026id=af62f622850fc7c0%5Cu0026ip=63.177.146.192%5Cu0026initcwndbps=1382250%5Cu0026mt=1791201409%5Cu0026oweuc=</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://schema.org/Comment</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/Person</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://studio.youtube.com/persist_identity</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/youtube/?p%5Cu003dcreator_community</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/youtube/answer/3037019#zippy=%2Ccheck-that-youre-signed-into-youtube</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/youtube/contact/de_cancellation</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/youtube/img/emojis/emojis-png-15.1.json</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/youtube/img/lottie/audio_indicator/audio_indicator_v2.json</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/youtube/img/lottie/custom_animated_like_icon/animated_like_music_dark_v5.json</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/youtube/img/lottie/custom_animated_like_icon/animated_like_music_light_v5.json</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.youtube.com/@mosa.modiba</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/about/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/about/copyright/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/about/policies/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/about/press/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/ads/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/creators/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/csi_204</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/error_204?t=jserror&amp;level=ERROR</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/howyoutubeworks</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/howyoutubeworks?utm_campaign=ytgen&amp;utm_source=ythp&amp;utm_medium=LeftNav&amp;utm_content=txt&amp;u=https%3A%2F%2Fwww.youtube.com%2Fhowyoutubeworks%3Futm_source%3Dythp%26utm_medium%3DLeftNav%26utm_campaign%3Dytgen</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/opensearch?locale=en_US</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/_/ytmainappweb/_/js/k=ytmainappweb.kevlar_base.en_US.QoIJCn4IPpA.es5.O/am=AAAAACAAEICU/d=1/rs=AGKMywHT-kg6h9MOcrOhuzsJKuNVq7h-aw/m=kevlar_base_module</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/_/ytmainappweb/_/js/k=ytmainappweb.kevlar_base.en_US.QoIJCn4IPpA.es5.O/am=AAAAACAAEICU/d=1/rs=AGKMywHT-kg6h9MOcrOhuzsJKuNVq7h-aw/m=kevlar_base_module,kevlar_main_module,kevlar_base_sync_mod_chunk</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/_/ytmainappweb/_/ss/k=ytmainappweb.kevlar_base.uQ1HlB1diic.L.B1.O/am=AAAAACDAEMCe/d=0/rs=AGKMywH6gMRRYIHzsGE78gLeEn1vJBTsDQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/canvas_advanced_wasm/canvas_advanced_cc.wasm</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/canvas_lite_wasm/canvas_lite_cc.wasm</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/cssbin/www-main-desktop-player-skeleton.css</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/cssbin/www-main-desktop-watch-page-skeleton.css</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/cssbin/www-onepick.css</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/img/favicon_144x144.png</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/img/favicon_32x32.png</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/img/favicon_48x48.png</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/img/favicon_96x96.png</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/jsbin/intersection-observer.min.vflset/intersection-observer.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/jsbin/lottie-light.vflset/lottie-light.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/jsbin/network.vflset/network.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/jsbin/scheduler.vflset/scheduler.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/jsbin/spf.vflset/spf.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/jsbin/webcomponents-sd.vflset/webcomponents-sd.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/webgl2_advanced_wasm/webgl2_advanced_cc.wasm</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/s/desktop/85a3164d/webgl2_lite_wasm/webgl2_lite_cc.wasm</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/t/impressum?hl=de&amp;gl=DE</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/watch?v%5Cu003dNCh3rdJ-gEU%5Cu0026list%5Cu003dRDNCh3rdJ-gEU%5Cu0026start_radio%5Cu003d1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://youtubei-att.googleapis.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/25N38gfsd6fJloV3h32LqNmlBiw598yLUvzW2GHuYwuHjrJQPy88cFoe9vcxcCGgLt02nMCT3w=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/3Q-_A2gAS-aAhVOqM_PZBqBpN63aeBMc4ojQspzZ9trK2qiL3FXgwQITRWrEetMI7_Rg_F2pRQ=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/4HtIc_vsGSl-TC1nT--zhQruMabvRQoH-k8eh5CbQuCF7wa1ACw0lwsKAJcsLs2XU14sU25gzg=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/4a0ojVocnjZSrMHo7G5NTf7lgqxQ0u9wwFaq3_vmHcfaMXt7Mv3EguAmBS6X-qMROO6DDiaf4GY=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/AQZFmmYwEdvWqfc3aDCM4Kd8i6pxlVLKNNdAlmpJfKau7NMltxGFIYeRZDNjUTVymIpLsHLXL7U=s68-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/B6X6BoLMs49Y1jTw_5ULREwdKIZHM4ukO64wmkC1A8FWYNs_eZhIBOemQ7zZq81AFHE8B7Dup8Y=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/DdovA7GQUbAQjxQOS57iY_2YgM8LtSNIegJBRZeMv53sRvHoMu5vxhCMlVL9O824zHPWyVRjfA=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/PUuNuA_jeYIz12DoRUHV7F0yBtrKWSCVuCxY-YXC89_BPUK6Xz2Drmzb3ushLAEOSkIlhz_f=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/UYoT9epCkf7Lt25vFy7GQL4qEdHY5zpelQlIIMEvlKnmBWJKsWSkBBFp_sWvbWJL081RsVFw=s68-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/UvTHY9IMqpOp2Lep6ElE2sCkn7vb6Yrc5gfga9bU9mmihOZ0_CKoAHEKkBP3i-oyGl7amSvAHw=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/VFuOr3fLtffolkMLU6fOvIsxnLRj5P8G2ahJO-9zoIW5MfSaj1StjLe0SLv7LzSq4gGuPL92eg=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/Ztq-tzUyMV0KpnybHApHLsB8kP8JrXrwQnCQmarPA4Zu30gYRcPi-colhEg_x_zVQ1Ddjm8Oag=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/bH9xQ2_BIUmWMfIpDbQk3S908_k8J3tl3IV0fk79xrjzsPY8QHJLn2pCLvJZHhrznxco6S-okdA=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/dDDTFeKuJ_MVl7eSKeapwWYAUtfDj_DSE3dMLsy6CO9GxQarke6bKPTFOlqO68nq49NmVz4V=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/eJuZ4625snbHZlLnFL7P6qVp7yoV1rqGcae1N7tz9UiaGkvIeXzVDwp4RH8348yBwbyBOWvj9Q=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/kN7FpguLNUCp-lov-ixalsLq2KdCUFIGZMFi3PHQeROXYAnYwG_ZDRyei-2fuoPhnJy2INN-nw=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/nLudZoa5QOte3dLbHb3QCfyuOMcQGBS8d3uvbmKT21DrYcWJPIxQXn4G_3W6Psdy41unV4rDKw=s176-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/nLudZoa5QOte3dLbHb3QCfyuOMcQGBS8d3uvbmKT21DrYcWJPIxQXn4G_3W6Psdy41unV4rDKw=s48-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/nLudZoa5QOte3dLbHb3QCfyuOMcQGBS8d3uvbmKT21DrYcWJPIxQXn4G_3W6Psdy41unV4rDKw=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/pZhAAxFy8KavqHEGqfpBDExlUYvAlRzmT8mtGmiYOTS_qHNS0OnSqjSaA9lfaiPvHCb6T4WRDGw=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/tiFjAImmFFqQRE87tcIKbpNm2Bwu9YEq3mBlKjsDJKWZHJ2wdwCtTgekq4TivWqPNpnScKPdsA=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/xLqF2bxmFeSjpTgZ-ua-bQDCV4cY591O_PQrHU079aAwwrnYSFSUqIf4x1AYx6sB6HgNLQEZGg=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/y0epLAGHen3qwJVWoEkBIA5YeSFuhkljPH8VdwAoPbzJNO6mpDuVAoSNbYXBrg6MQiHPkO9yxTM=s88-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/ytc/AIdro_mQTcp8KZlFcrMUmbd7SDoVh-m8xDpDDu-qGgFFwDuiGg=s68-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/ytc/AIdro_mR9YvVQWryQq9p9QBP8dow8ZDzVdD-SdEo1ZMCXjl79Q=s68-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.ggpht.com/ytc/AIdro_nHdukFuLnuUvJhut5peRkSXCgbdzqPhaCHrVYH_24HPQ=s68-c-k-c0x00ffffff-no-rj</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://yt3.googleusercontent.com/piGx7kEkiuTxyj1Odm-g5t8VeOYv4jHy-Vg2vuYXm6yY6tbwXvOBWwOaJYjPyVf1HbBT-Lr9WAImWMuZ</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.youtube.com/watch?v=NCh3rdJ-gEU&amp;list=RDNCh3rdJ-gEU&amp;start_radio=1</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>accountlinking-pa-clients6.youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>accounts.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>apis.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>client-channel.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>clients4.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>consent.youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>developers.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>families.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>i.ytimg.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>m.youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>payments.youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>policies.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr1---sn-4g5e6nss.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr1---sn-4g5edndl.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr1---sn-4g5edndy.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr1---sn-4g5ednkd.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr1---sn-4g5ednre.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr1---sn-4g5lznl7.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr1---sn-4g5lznld.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr1---sn-u14g55-cj.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr1---sn-u14g55-jq.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr2---sn-4g5ednde.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr2---sn-4g5edndr.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr2---sn-4g5ednk6.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr2---sn-4g5ednre.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr2---sn-4g5ednrl.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr2---sn-4g5ednrz.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr2---sn-4g5ednsr.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr2---sn-4g5lznl7.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr2---sn-4g5lznld.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr2---sn-aj4g55-5v.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr2---sn-aj4g55-5w.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr2---sn-aj4g55-j5.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr2---sn-u14g55-5c.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr2---sn-u14g55-jq.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr3---sn-4g5edndy.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr3---sn-4g5ednsr.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr3---sn-4g5lznl7.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr3---sn-4g5lznss.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr4---sn-4g5ednrs.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr4---sn-4g5edns6.c.youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr4---sn-4g5edns6.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr4---sn-4g5lzner.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr4---sn-4g5lznse.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr4---sn-u14g55-cw.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr5---sn-4g5e6ns7.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr5---sn-4g5e6nze.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr5---sn-4g5lznek.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr5---sn-4g5lznly.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr5---sn-4g5lzns7.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr5---sn-aj4g55-5t.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rr5---sn-u14g55-5c.googlevideo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>studio.youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.gstatic.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>youtubei-att.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>yt3.ggpht.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>yt3.googleusercontent.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>wght@300..900</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>74.125.99.17</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>173.194.10.70</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>74.125.163.166</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>173.194.1.6</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.92</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>173.194.182.198</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.84</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.119</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>74.125.162.166</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>173.194.6.166</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>74.125.154.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>05fc576f3568595b95c3dcd2559b93e7cdafc462ef7b6e87da767a90d8cef1ca</SHA-256>
              <SHA-1>b7e49c9bf91ffa8fce387147d9515ca42e6690dc</SHA-1>
              <MD5>a016765393762b98e05a51c7b30834a1</MD5>
              <origin>CONTENT_PARSE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>c316167c68379ca42828a70d2ed970393f701f5e3d3471aa5aeac5c1691b95eb</SHA-256>
              <SHA-1>23d2f205304c14d7204aea74e264de239b8fae33</SHA-1>
              <MD5>95234a606fa9ec3a9bec4ef562146c6f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>291dd2c32d3c52cdf9c8d9b219c89d95a13a95702050fb2536f8d9cb25876a0a</SHA-256>
              <SHA-1>5dfa98ca3863ce1438c247becd5aae704a19167f</SHA-1>
              <MD5>b2d61d6b1b8c83815a652e2517bde995</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>f7a09d96641a041a2cc7add5ee83b049f6b04a8d2d6c3492a92da6ba4fb4adc6</SHA-256>
              <SHA-1>b4801a83920d3a733a209e19c390f1c048e804de</SHA-1>
              <MD5>e7b1b8d34c938448aa03821404c60643</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>8cd466fd36ac9f2b5ae3bf39480777258659f86e44963e250858883ad1823949</SHA-256>
              <SHA-1>8ffb8f2af061dce09a4cea1915050c21e345f1af</SHA-1>
              <MD5>5a961e58201556ae5ca145e78b4716be</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>4ec3918c447ebe4af35c96fb1f7641d540975ed21552d4a7373c9a4a2a5c2532</SHA-256>
              <SHA-1>a50f908ac59e7ad5074c63e640ff2a1231ce9e2a</SHA-1>
              <MD5>9b0e7491f17a2cda466a011e81935684</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>9a1f0b773eacef8b06b37b25775877b4297c8b2cf8fa53bc82f09516948fdd3b</SHA-256>
              <SHA-1>bfe007ef4d258576790983292c845e4e067b6f93</SHA-1>
              <MD5>261e8ac8166c08fda85f33f102294ec2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>1fb1155a6295dfa7f0fb32692b672d505d5aeb28c70f225af4562d435d59ace6</SHA-256>
              <SHA-1>6d5aca8e161e40f6add41c5c3b8907166e519418</SHA-1>
              <MD5>4ac7fdfd87d3e70760b4bc21bdd91eef</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>54ee3a50f6a6e8aeb11d063edbd674677edbe5e0121bbbc26490f5b6dcc7710e</SHA-256>
              <SHA-1>8318ed79e33e07e5172abc4228b52a14b220455c</SHA-1>
              <MD5>dfe8d8485fe7b85218027edba378318e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>08ca64674febdf14afa80472673cc53764907519be0a15cd641cd234b2f8bc73</SHA-256>
              <SHA-1>b6caf16250d0ac2e5cc0d59a1154a45862cb34e4</SHA-1>
              <MD5>59f30a4c9477409c1213d22aa1a2e72a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://www.youtube.com/watch?v=NCh3rdJ-gEU&amp;list=RDNCh3rdJ-gEU&amp;start_radio=1</name>
        <report_id>bfec9313-6c06-43af-9bd6-8b060d87c267</report_id>
        <tags>
          <value>html</value>
          <value>base64</value>
          <value>obfuscated</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e291134463bac24ac6098ddbead02794c0db18dcca7eb8f199feebf884395796</id>
    <title>Analysis Report for e291134463bac24ac6098ddbead02794c0db18dcca7eb8f199feebf884395796</title>
    <updated>2026-10-05T12:03:10Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3923fd130e7ad45267648</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6ac391fc7e4998b7d617ffa9</flow_id>
        <hash>e291134463bac24ac6098ddbead02794c0db18dcca7eb8f199feebf884395796</hash>
        <iocs>
          <urls>
            <value>
              <url>http://www.binance.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.bitrefill.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.coinbase.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.crypto.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.etoro.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.binance.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.bitrefill.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.coinbase.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.crypto.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.etoro.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.binance.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.bitrefill.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.coinbase.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.crypto.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.etoro.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.binance.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.bitrefill.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.coinbase.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.crypto.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.etoro.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>file:///tmp/tmpez9tm6_5.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.binance.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.bitrefill.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.coinbase.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.crypto.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.etoro.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>binance.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>bitrefill.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>coinbase.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>crypto.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>etoro.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>binance.com</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>bitrefill.com</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>coinbase.com</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>crypto.com</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>etoro.com</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>www.binance.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.bitrefill.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.coinbase.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.crypto.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.etoro.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>binance.com</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>bitrefill.com</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>coinbase.com</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>crypto.com</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>etoro.com</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>binance.com</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>bitrefill.com</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>coinbase.com</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>crypto.com</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>etoro.com</url>
              <origin>CONTENT_PARSE</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.18.35.15</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.19.223.17</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>157.187.179.37</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>104.20.27.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>52.196.80.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>23.45.106.112</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>d76ff95e2aa7ea104139608b2d5b1995029e65b868a62714986bddceb6b8f721</SHA-256>
              <SHA-1>54be582a640f52450488e15ead49d79077f0782d</SHA-1>
              <MD5>3f1f071559f1bcc231f88afd87956ad6</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>c335a733e0daff73bf98401f398cd9e49a149654a91e23280effcdf26179be53</SHA-256>
              <SHA-1>c12f3a9a19f173838d7936f1a1d092d743706a08</SHA-1>
              <MD5>a71e9bf24d73a8ffe75b02f4f7f8b865</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>12741beb4f98ef168865a86d0bfc0587b1def92fe4095379f9177031a5bcb4b1</SHA-256>
              <SHA-1>53aa388fa0953ad33f0f6a1c7b3dd46db7458897</SHA-1>
              <MD5>95c9ef753fc3e9a297b3aa1fb104f686</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>624a0c06fb586bd871055eaaafaded6c6ed0ae9a8ca248f2ea7d55bf41e67a52</SHA-256>
              <SHA-1>0035d8a643bc5fcd6f7689420bcbf9d8cde642a8</SHA-1>
              <MD5>35f2140849a4881e143efa16770ca5d9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>aaa8f71e21dc9a7e14502eabb42c864751236954d18a4f550f88b159adeb7c6e</SHA-256>
              <SHA-1>01687f56eab35ce5d30265d9f386ed36bcea34c8</SHA-1>
              <MD5>ff96ce1191ba2f0f6123575e8557b9de</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>submission.eml</name>
        <report_id>8bf55ae5-791b-480b-8b17-eb388c2c8742</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
          <value>html</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a037acecbc3cade277c0241a3180297e56bbc8afafdc36a7641ca599acc8d532</id>
    <title>Analysis Report for a037acecbc3cade277c0241a3180297e56bbc8afafdc36a7641ca599acc8d532</title>
    <updated>2026-10-05T12:02:49Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac391fad130e7ad4526763a</_id>
        <file_type>application/pdf</file_type>
        <flow_id>6ac391e77e4998b7d617ff78</flow_id>
        <hash>a037acecbc3cade277c0241a3180297e56bbc8afafdc36a7641ca599acc8d532</hash>
        <iocs>
          <emails>
            <value>
              <email>fastebidia@cie.ci</email>
              <origin>CONTENT_PARSE</origin>
            </value>
          </emails>
          <files>
            <value>
              <SHA-256>06b352d5e978a1f6122e639c2915052f80d3a605489313178f527766bd1fe63c</SHA-256>
              <SHA-1>75d3e52f7582e902710467284fd7c3682a3931e5</SHA-1>
              <MD5>03d14f79a92678c9f56416c438845fc3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>0d8be263f9f36cfe6779803a3d9bd8bc6e463a5ea77055fd87bcecab2ef906d5</SHA-256>
              <SHA-1>048541faf79b00f517fae9e44122ed79448ef52c</SHA-1>
              <MD5>0a5fc7667094a960a22b44b6def0ec38</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>3ba90b93840be81ec2f0ef31adfaaf6fdb408693d61f7e9427df3904ba0056ed</SHA-256>
              <SHA-1>dec33c9530f2228b709ea7ad62ca62bc56373bb5</SHA-1>
              <MD5>5b01f4a75bf749187bdf0124bf61d06a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>7601f8e3fb021bd454dc64c7196e3eafff60c14d6ddcd1885118f11f2c65bcb7</SHA-256>
              <SHA-1>c157033ca2ef044fb82e5995b6abf8c911b4623b</SHA-1>
              <MD5>b6192ed9a02f5d1653eaff19dc7b3c8e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>83e6a28aad57a5cdad97e1b598070cb9fcc4605250ba847e0d7520368b2f56a7</SHA-256>
              <SHA-1>5401f5cadce51907b936695e2ece0b6612c18f07</SHA-1>
              <MD5>6ebbe4759ad69ab7a3991df58d5adc21</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>9365c255181ff1c74991c3bbd589afc04e8d398014a0d8b8b9e817cd4a862b1f</SHA-256>
              <SHA-1>92e6b3924867c0b306bdac612e11c83148cc85cf</SHA-1>
              <MD5>66b56db977543a7610faf64c65768bb8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>9b1ee564b76ba94f18a06cc622ae2cbca60bfbb4262c3665ab80fae4a0d2a155</SHA-256>
              <SHA-1>95d4b775b2e6b8df99f0903c90ea8128b750d603</SHA-1>
              <MD5>0329ea1e012e6dabcb0074286484e58d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>bfcbf021c8280c7e95e0067d75efaee10f26da0edbb461ae7040f9463dd5e7cd</SHA-256>
              <SHA-1>4c47b9f48bb748a26c52ebab6d8e3a053628cd27</SHA-1>
              <MD5>dc9298deab7478f34a35dcbc6344fbcc</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>c9efe969938a230bc97f6488aab02d592a52f8dab822b9cd502be042aeadf3c1</SHA-256>
              <SHA-1>2d99711a4dfd0b3fe4df5646f2f1326bec0c328a</SHA-1>
              <MD5>3cb09bd008de0694153e5cae3b5ed997</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>d8c373261e74d4a127c538b53d2de26df3e739e4049801190c8b5c510fd5729a</SHA-256>
              <SHA-1>1b1ae626e222f822272e07250006e1c30d2433b8</SHA-1>
              <MD5>d6a0146428b3471bec67bd9051b3f40e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>40ba843c-c945-fd47-aea0-13122a97f1f8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>9c3dc6cd-aa63-2a41-9e3d-f250604d809a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>BREVES INFOS CIE - DDRH PROGRAMME LUMIERE.pdf</name>
        <report_id>0f1da9f3-7d27-4bdf-a89f-75d0d9e0108d</report_id>
        <tags>
          <value>pdf</value>
          <value>form</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>962d3a89c42ed984f4a68c2466931e2531e434ed28fe3b712d64c9eeb9185b06</id>
    <title>Analysis Report for 962d3a89c42ed984f4a68c2466931e2531e434ed28fe3b712d64c9eeb9185b06</title>
    <updated>2026-10-05T12:02:49Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39206d130e7ad4526763e</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6ac391e7dedbc9646d41c67e</flow_id>
        <hash>962d3a89c42ed984f4a68c2466931e2531e434ed28fe3b712d64c9eeb9185b06</hash>
        <iocs>
          <urls>
            <value>
              <url>http://pekora.pro</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/emilk/egui/issues</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/rust-windowing/winit</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/source-foundry</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/source-foundry/Hack/blob/master/LICENSE.md</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/source-foundry/HackThe</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://pekora.pro/bootstrapper/PekoraPlayerLauncher.exe</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://www.pekora.pro</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>github.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>pekora.pro</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>appro@openssl.org</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>172.67.210.94</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.121.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>2a551b191a6a8832bde787caa474b1a52fa5e818a07b12af5f28ecb23c2ac374</SHA-256>
              <SHA-1>22b9035786784511f44c56ccabc492319de80ec7</SHA-1>
              <MD5>7ed5b3fc7d811c7a75ff63513627c48c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>3f775a43bf27c55e3562b6c03b3e5e4de13591455f7510e3a7e2538c65db6029</SHA-256>
              <SHA-1>6d8864c6b74826103e61425e67decbf9697530a0</SHA-1>
              <MD5>48f75483b41fae2cb5cb38a982769482</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>9935dbb3d6b52da1253db5327d25f591a6f750e9e57e6a1d775abbef364c4a8e</SHA-256>
              <SHA-1>29789bcafb9e87ffbf03c7628f6ac5d1983387f2</SHA-1>
              <MD5>d811a3b9b9ee8c1aaff268971c74907d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>ba2f9cc4cc104a6df1d711148c357b48cba28ac1ad534015f93e23f52ba1eda7</SHA-256>
              <SHA-1>d7317b00a46830f5d1c2bfd22d98c1cae657c283</SHA-1>
              <MD5>82e99a1511db8a3fe4d859f3a2ed94e5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>bd9dda152cf01365c73f8baf5c97ec3c8d295cb5eb2f983ae709c55d39d49e17</SHA-256>
              <SHA-1>47c253eacb7f6e572304d137b443ccaa31984a38</SHA-1>
              <MD5>87b9580556509fc86d48a7ddc84fad75</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>cef37a67c2613adae364b7c847cb55717dd47e07bb04f3e4adda60853e1c80fb</SHA-256>
              <SHA-1>e162749f7a51a7056888523b86c49c767c67c8c0</SHA-1>
              <MD5>d3ede15200123b3cc5b81978692ebce0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>d74ac40a6d77debd676aac32664f4b8685b3fa9b62e5633120c2c3b4426c7a06</SHA-256>
              <SHA-1>8afda57f8f5552586832e01cd3a082327b08dec1</SHA-1>
              <MD5>f12d13160197548953cb1486ff030fe0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>f9bbaa51b2ca6d168544fed62bc923f8f7c3f5b61151a57ba8d933430f51468c</SHA-256>
              <SHA-1>6e17eddcaed267f4a4c0ce1c51b4acc7a6eb68d6</SHA-1>
              <MD5>2e87863f42ab5c57c5de2c7f8295de74</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>56c4a72d16574c0396b9be192a11be5a36dae20d9539346f212584a1a16c1629</SHA-256>
              <SHA-1>5c22d6cede4a071103c20be13b4c8823ad1e2b29</SHA-1>
              <MD5>ac11e57231b3744d66db244e98c498f8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>23e08c6bd0edcb9910ae825329971bc1524a22910beae95ed54722519c7ad608</SHA-256>
              <SHA-1>deca6b6bad57f216f95d3184c3854083db98e3a7</SHA-1>
              <MD5>0b8a5a6c75ec0aed74691f642c18e62f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>27ed51199f3b26351220ad92a09298cf8ed4e5f385bfea77983316d99afeb1bc</SHA-256>
              <SHA-1>8069c9634467f5fa3935929f6de75d29f1faf7b0</SHA-1>
              <MD5>10b36d037427ec8156ffd158de4ad45c</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>904fe364b6d6e535570e4231fdaa1ebf573ba72928af58aa2b1fde3bc23989d5</SHA-256>
              <SHA-1>384205cc4100fc272afd3323d5de01b8b6b891df</SHA-1>
              <MD5>eed8777981b886f2b74e2e58af6c69b1</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>4141d0621bd04fdbae5d40f0e16e313bcfe2796e4456e49cfd4b9fc38498e065</SHA-256>
              <SHA-1>c4e2e1ca8e34a6b7065d03eb76e8881c47984e00</SHA-1>
              <MD5>5a007ce854cf47c49e0938bcea767e5f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <registry>
            <value>
              <registry>Software\Classes\</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Classes\.</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>hxxps://pekora.pro/bootstrapper/PekoraPlayerLauncher.exe</name>
        <report_id>6a345a8f-2561-48aa-a2e1-663c223f5603</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>keylogger</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>rust</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f3947d244239d90298c7c3323a6d83042bb4f38c821f1bdefa449e7dfd9e2976</id>
    <title>Analysis Report for f3947d244239d90298c7c3323a6d83042bb4f38c821f1bdefa449e7dfd9e2976</title>
    <updated>2026-10-05T11:59:38Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3913bd130e7ad45267617</_id>
        <file_type>text/x-robots</file_type>
        <flow_id>6ac39127766af099f2b3a381</flow_id>
        <hash>f3947d244239d90298c7c3323a6d83042bb4f38c821f1bdefa449e7dfd9e2976</hash>
        <iocs>
          <urls>
            <value>
              <url>https://wordpress.org/documentation/article/search-engine-optimization/#robots-txt-optimization</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.mediawiki.org/wiki/Manual:Robots.txt</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://wordpress.org/documentation/article/search-engine-optimization/#robots-txt-optimization</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.mediawiki.org/wiki/Manual:Robots.txt</url>
              <origin>CONTENT_PARSE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>mediawiki.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>wordpress.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>mediawiki.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>wordpress.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>185.15.59.224</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>66.6.42.252</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>085c98d8daebb2062cac261736b06e4b22cffcf8481d60e9b1054667ba9d396f</SHA-256>
              <SHA-1>416ad3d85e2621241468806d155dba5300f6ca90</SHA-1>
              <MD5>5613cecfb9b5e01e6d9d081fe8e22589</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>d90a7b66518b4c38de4afba4a7da08f5d4dbcb31d9862e9db8f6f67a321faba7</SHA-256>
              <SHA-1>54ab06a8e6212db9311b4fe377b51ff7927146b7</SHA-1>
              <MD5>c3ea4fb2c4069a5110f7963ed0a0596f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>cert_robots.txt</name>
        <report_id>c6272f28-ffc9-445f-a47a-51b949ca9af9</report_id>
        <tags>
          <value>txt</value>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>1f1cbac7ae9dabb712b11f4b43ba55662c434a7ed9188c3e795274ce274796d4</id>
    <title>Analysis Report for 1f1cbac7ae9dabb712b11f4b43ba55662c434a7ed9188c3e795274ce274796d4</title>
    <updated>2026-10-05T11:59:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3915ed130e7ad4526761e</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39115766af099f2b3a2f4</flow_id>
        <hash>1f1cbac7ae9dabb712b11f4b43ba55662c434a7ed9188c3e795274ce274796d4</hash>
        <iocs>
          <urls>
            <value>
              <url>https://nordichomeix.com/search?q=devoko%20divano%20chaise%20longuwe&amp;page=1</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/?q=devoko+divano+chaise+longuwe&amp;page=1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.google.com/?q=devoko+divano+chaise+longuwe&amp;page=1&amp;noiga=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/?q=devoko+divano+chaise+longuwe&amp;page=1&amp;noiga=1&amp;ec=GAZAmgQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://about.google/?utm_source=google-DE&amp;utm_medium=referral&amp;utm_campaign=hp-footer&amp;fg=1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/ListAccounts?listPages=0%5Cu0026pid=538%5Cu0026gpsia=1%5Cu0026source=ogb%5Cu0026atic=1%5Cu0026mo=1%5Cu0026mn=1%5Cu0026hl=de%5Cu0026ts=157</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/Logout</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/Logout?hl=de%5Cu0026continue=https://www.google.com/%3Fq%3Ddevoko%2Bdivano%2Bchaise%2Blonguwe%26page%3D1%26noiga%3D1%5Cu0026ec=GAdAmgQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?hl%5Cx3dde%5Cx26continue%5Cx3dhttps://www.google.com/?q%3Ddevoko%2Bdivano%2Bchaise%2Blonguwe%26page%3D1%5Cx26gae%5Cx3dcb-bip</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?hl=de%5Cu0026passive=true%5Cu0026continue=https://www.google.com/%3Fq%3Ddevoko%2Bdivano%2Bchaise%2Blonguwe%26page%3D1%26noiga%3D1%5Cu0026ec=GAZAmgQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?hl=de&amp;passive=true&amp;continue=https://www.google.com/%3Fq%3Ddevoko%2Bdivano%2Bchaise%2Blonguwe%26page%3D1%26noiga%3D1&amp;ec=GAZAmgQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/SignOutOptions</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/SignOutOptions?hl=de%5Cu0026continue=https://www.google.com/%3Fq%3Ddevoko%2Bdivano%2Bchaise%2Blonguwe%26page%3D1%26noiga%3D1%5Cu0026ec=GBRAmgQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://consent.google.com/d</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://consent.google.com/d?continue%5Cx3dhttps://www.google.com/?q%3Ddevoko%2Bdivano%2Bchaise%2Blonguwe%26page%3D1%5Cx26gl%5Cx3dDE%5Cx26m%5Cx3d1%5Cx26pc%5Cx3dshp%5Cx26uxe%5Cx3dbip%5Cx26cm%5Cx3d2%5Cx26hl%5Cx3dde%5Cx26src%5Cx3d2%5Cx26escs%5Cx3dAUjHKweLghC3lx_fWOXMgoxUmxtwdfPAb8OXMKu_9lca6hJF7kczOS9Mga755u2OaFfBiTSwy-zfs10-TkTncTjpgbh64Spn0y_x</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://consent.google.com/d?continue=https://www.google.com/?q%3Ddevoko%2Bdivano%2Bchaise%2Blonguwe%26page%3D1%5Cu0026gl=DE%5Cu0026m=1%5Cu0026pc=srp%5Cu0026cm=5%5Cu0026hl=de%5Cu0026src=4</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://consent.google.com/save</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://consent.google.com/save?continue%5Cx3dhttps://www.google.com/?q%3Ddevoko%2Bdivano%2Bchaise%2Blonguwe%26page%3D1%5Cx26gl%5Cx3dDE%5Cx26m%5Cx3d1%5Cx26pc%5Cx3dshp%5Cx26x%5Cx3d5%5Cx26src%5Cx3d2%5Cx26hl%5Cx3dde%5Cx26bl%5Cx3dgws_20261001-0_RC1%5Cx26uxe%5Cx3dbip%5Cx26cm%5Cx3d2%5Cx26set_eom%5Cx3dfalse%5Cx26set_aps%5Cx3dtrue%5Cx26set_sc%5Cx3dtrue%5Cx26escs%5Cx3dAUjHKwc0VyE7ppf2ad-o_WWO4ikoXQmZHNHzxbzk4stVmX5whXV1Ne4tQbHRHjELHvUQi2M6wUYdBqGT5XAasajDcLsOP7br1bWp</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://consent.google.com/save?continue%5Cx3dhttps://www.google.com/?q%3Ddevoko%2Bdivano%2Bchaise%2Blonguwe%26page%3D1%5Cx26gl%5Cx3dDE%5Cx26m%5Cx3d1%5Cx26pc%5Cx3dshp%5Cx26x%5Cx3d5%5Cx26src%5Cx3d2%5Cx26hl%5Cx3dde%5Cx26bl%5Cx3dgws_20261001-0_RC1%5Cx26uxe%5Cx3dbip%5Cx26cm%5Cx3d2%5Cx26set_eom%5Cx3dtrue%5Cx26escs%5Cx3dAUjHKwdZm7Ee1NG7-ZDqt00PzeyZgM9cOmeecyF-RhtK0LRD9Neogo1uUvXsiN3nINKJyXH-ZEQuAGSfEs_mp15xWDgBLGt0ytl-</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/ogw/default-user=s83</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ogads-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ogs.google.com/widget/account/so?baea=1%5Cu0026cc=1%5Cu0026oame=1%5Cu0026ame=1%5Cu0026ube=1%5Cu0026pppea=2%5Cu0026dpi=89978449%5Cu0026eom=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ogs.google.com/widget/app/so?eom=1%5Cu0026awwd=1%5Cu0026em=2%5Cu0026scv=1%5Cu0026dpi=89978449</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ogs.google.com/widget/callout?eom=1%5Cu0026dc=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ogs.google.com/widget/expressaccountpicker?eom=1%5Cu0026eap=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=de&amp;fg=1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=de&amp;fg=1&amp;utm_source=ucbs</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/technologies/cookies?utm_source=ucbs&amp;hl=de</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/terms?hl=de&amp;fg=1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/terms?hl=de&amp;fg=1&amp;utm_source=ucbs</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/chrome/?p%5Cx3dui_voice_search%5C%5C%5Cx22</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/websearch/?p=dsrp_search_hc%5Cu0026hl=de</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/websearch/?p=ws_results_help&amp;amp;hl=de&amp;amp;fg=1%5C</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.google.com/?q%253Ddevoko%252Bdivano%252Bchaise%252Blonguwe%2526page%253D1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/?q%253Ddevoko%252Bdivano%252Bchaise%252Blonguwe%2526page%253D1#languages</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/?q%3Ddevoko%2Bdivano%2Bchaise%2Blonguwe%26sca_esv%3Dcbebc86b742c5175%26output%3Dsearch%26pccc%3D1%5Cu0026sig=0_j6YlWGpXFkgfE9WXN9zrltPnHEM%3D%5Cu0026cs=2</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/?q=devoko+divano+chaise+longuwe%5Cu0026page=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/intl/de_de/ads/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.google.com/intl/de_de/ads/?subid=ww-ww-et-g-awa-a-g_hpafoot1_1!o2&amp;utm_source=google.com&amp;utm_medium=referral&amp;utm_campaign=google_hpafooter&amp;fg=1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.google.com/preferences?hl=de</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/preferences?hl=de&amp;amp;fg=1%5C</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/services/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.google.com/services/?subid=ww-ww-et-g-awa-a-g_hpbfoot1_1!o2&amp;utm_source=google.com&amp;utm_medium=referral&amp;utm_campaign=google_hpbfooter&amp;fg=1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.google.com/setprefs?sig=0_j6YlWGpXFkgfE9WXN9zrltPnHEM%3D&amp;hl=en&amp;source=homepage&amp;sa=X&amp;ved=0ahUKEwidq_Xk6aKXAxVdRPEDHdVfAPAQ2ZgBCBs</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/webhp?authuser=$authuser</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/webhp?q=devoko+divano+chaise+longuwe&amp;sca_esv=cbebc86b742c5175&amp;output=search&amp;tbm=isch&amp;tbo=u&amp;sa=X&amp;ved=0ahUKEwidq_Xk6aKXAxVdRPEDHdVfAPAQ0tQDCAUoAQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.de/intl/de/about/products</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Z_h7KLOcZhU.2019.O/rt=j/m=qabr,q_dnp,qcwid,qapid,qads/exm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/rs=AA2YrTsvNqqtS27bFj62rqO38zdQBMgP8g</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/og/_/ss/k=og.qtm.bSTUVhLAlBs.L.W.O/m=qcwid,d_b_gm3,d_wi_gm3,d_lo_gm3/excm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/ct=zgms/rs=AA2YrTtmjaleZ4d_o1nhaBsvbGkiz9S8Fw</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://about.google/?fg=1&amp;utm_source=google-DE&amp;utm_medium=referral&amp;utm_campaign=hp-header</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?hl=de&amp;passive=true&amp;continue=https://www.google.com/%3Fq%3Ddevoko%2Bdivano%2Bchaise%2Blonguwe%26page%3D1&amp;ec=futura_exp_og_so_72776762_e</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://consent.google.com/d</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.google.com/d?continue=https://www.google.com/?q%3Ddevoko%2Bdivano%2Bchaise%2Blonguwe%26page%3D1&amp;gl=DE&amp;m=0&amp;pc=shp&amp;cm=5&amp;hl=de&amp;src=4</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/googlesans/v29/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/i/productlogos/googleg/v6/24px.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://google.com/search/howsearchworks/?fg=1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://mail.google.com/mail/&amp;ogbl</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ogads-pa.clients6.google.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://play.google.com/log?format=json&amp;hasfast=true</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=de&amp;fg=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=de&amp;fg=1&amp;utm_source=ucbs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://policies.google.com/technologies/cookies?utm_source=ucbs&amp;hl=de</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://policies.google.com/terms?hl=de&amp;fg=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://policies.google.com/terms?hl=de&amp;fg=1&amp;utm_source=ucbs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://store.google.com/DE?utm_source=hp_header&amp;utm_medium=google_ooo&amp;utm_campaign=GS100042&amp;hl=de-DE</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://support.google.com/websearch/?p=ws_results_help&amp;hl=de&amp;fg=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://support.google.com/websearch/answer/106230?hl=de</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://sustainability.google/intl/de/klimaschutz/?utm_source=googlehpfooter&amp;utm_medium=housepromos&amp;utm_campaign=bottom-footer&amp;utm_content=</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.com/?q=devoko+divano+chaise+longuwe&amp;page=1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/async/hpba</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/async/hpba?vet=10ahUKEwjCqdnx6aKXAxWx_7sIHXt0EisQj-0KCCY..i&amp;ei=MZHDaoLNEbH_7_UP--jJ2AI&amp;opi=89978449&amp;yv=3&amp;sp_imghp=false&amp;sp_hpte=1&amp;sp_hpep=1&amp;stick=&amp;cs=0&amp;async=_basejs:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.de.Z2IWh1ARE_k.2023.O%2Fam%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQECAAAAEAAAAAAAAAAAAAAAgABAAAAAAAAAAAAAAAAAAAAAAABAQIAAkAAAAAAAAAAgAAEABABAAACAAAAADAAgAAiAAAAAwAAAAAAAAAAAAAAAAAAAAAAIQCAAAACEAAAAAPwDDLACAAAAAAAAAAAACQAwAAAAAAAAYAEAAABBAAAAAAQAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAEAAAAoAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAABAAAAAoAACAAACAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAABAAAAAAAAAAAgAAAAACUAAAAAAAAAAAAAAAgAAANABEHiAIQUFAAAAAAAAAAAAAAAAAAAAAAAAAAAABFAAu5ACAiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCTwEAAAAAAIDF%2Fdg%3D0%2Fbr%3D1%2Frs%3DACT90oFC9DjhEfnZ2iFaAVVCjUxW3rsTVA%3Fcb%3D121509378,_basecss:%2Fxjs%2F_%2Fss%2Fk%3Dxjs.hd.5xbvnRzz1h4.L.B1.O%2Fam%3DAAAEAAAgAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQBAUAAAAAAAAAAQAgAgAAABAAAAAAAAA4QAAAIABAAAAAACAAAAAAAAAAAAAABAAkAAAAAAAAAAgAAEADAAAAACACAAAAAAgAAiAAgAAEAAAAAAAAAAAQAAAAAAAAAAIFCAAAAAAAAAAAAAAAIAEAAAAAAAAAAAAgMAwQAAAAIBgAAAAAAAAAAAAAAAAAAAAAAAAAAAACAmQAAAIAAAAAAAQAAAAAAAAIiCEIAAQoICABQEAAAAAAAsAAAAAABoFBiQAAAAAAAAEAAAAIAAIAiGAAAAABAAAAAAQACAAgABAAAEARlAAAIkOEQAACAQAAAgAAQAAAAAgAAAAAAAAAAAAAIgAgAAAAAAAAACAJADAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK%2Fbr%3D1%2Frs%3DACT90oEGTIB-OFdQYoBzngAjIiPeG7oXNA%3Fcb%3D121509378,_basecomb:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.de.Z2IWh1ARE_k.2023.O%2Fck%3Dxjs.hd.5xbvnRzz1h4.L.B1.O%2Fam%3DAAAEAAAgAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQBAUAAAAAQECAAQAkAgAAABAAAAAAAAA4QBAAIABAAAAAACAAAAAAAAAAABAQJAAkAAAAAAAAAAgAAEADABAAACACAAADAAgAAiAAgAA0AAAAAAAAAAAQAAAAAAAAAAIVCAAAACEAAAAAPwDDLAGAAAAAAAAAAAAicAwQAAAAIBgYAEAAABBAAAAAAQAAQAAAAAAAAAACAmQAAAIAAAAAAAQAAAAAAAAIiCEIAAQoICABQEACAAAAAsAAAAAABoFBiQAAAAAAAAFAAAAIAAIAiGAAAAABAAAAAoQACAAgCBAAAEARlAAAIkOEQAACAYAAAgAAQAAAAAgAABAAAAAAAAAAIgAgAAACUAAAACAJADAAAEAAgAAANABEHiAIQUFAAAAAAAAAAAAAAAAAAAAAAAAAAAABFAAu5AKAiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCTwEAAAAAAIDF%2Fd%3D1%2Fed%3D1%2Fdg%3D0%2Fbr%3D1%2Fujg%3D1%2Frs%3DACT90oE9QiPz3foI1coJOv-5ol3O7L107g%3Fcb%3D121509378,_fmt:prog,_id:_MZHDaoLNEbH_7_UP--jJ2AI_19</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/async/hpba?yv=3&amp;cs=0&amp;ei=MZHDaoLNEbH_7_UP--jJ2AI&amp;async=_basejs:/xjs/_/js/k%3Dxjs.hd.de.Z2IWh1ARE_k.2023.O/am%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQECAAAAEAAAAAAAAAAAAAAAgABAAAAAAAAAAAAAAAAAAAAAAABAQIAAkAAAAAAAAAAgAAEABABAAACAAAAADAAgAAiAAAAAwAAAAAAAAAAAAAAAAAAAAAAIQCAAAACEAAAAAPwDDLACAAAAAAAAAAAACQAwAAAAAAAAYAEAAABBAAAAAAQAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAEAAAAoAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAABAAAAAoAACAAACAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAABAAAAAAAAAAAgAAAAACUAAAAAAAAAAAAAAAgAAANABEHiAIQUFAAAAAAAAAAAAAAAAAAAAAAAAAAAABFAAu5ACAiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCTwEAAAAAAIDF/dg%3D0/br%3D1/rs%3DACT90oFC9DjhEfnZ2iFaAVVCjUxW3rsTVA?cb%3D121509378,_basecss:/xjs/_/ss/k%3Dxjs.hd.5xbvnRzz1h4.L.B1.O/am%3DAAAEAAAgAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQBAUAAAAAAAAAAQAgAgAAABAAAAAAAAA4QAAAIABAAAAAACAAAAAAAAAAAAAABAAkAAAAAAAAAAgAAEADAAAAACACAAAAAAgAAiAAgAAEAAAAAAAAAAAQAAAAAAAAAAIFCAAAAAAAAAAAAAAAIAEAAAAAAAAAAAAgMAwQAAAAIBgAAAAAAAAAAAAAAAAAAAAAAAAAAAACAmQAAAIAAAAAAAQAAAAAAAAIiCEIAAQoICABQEAAAAAAAsAAAAAABoFBiQAAAAAAAAEAAAAIAAIAiGAAAAABAAAAAAQACAAgABAAAEARlAAAIkOEQAACAQAAAgAAQAAAAAgAAAAAAAAAAAAAIgAgAAAAAAAAACAJADAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK/br%3D1/rs%3DACT90oEGTIB-OFdQYoBzngAjIiPeG7oXNA?cb%3D121509378,_basecomb:/xjs/_/js/k%3Dxjs.hd.de.Z2IWh1ARE_k.2023.O/ck%3Dxjs.hd.5xbvnRzz1h4.L.B1.O/am%3DAAAEAAAgAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQBAUAAAAAQECAAQAkAgAAABAAAAAAAAA4QBAAIABAAAAAACAAAAAAAAAAABAQJAAkAAAAAAAAAAgAAEADABAAACACAAADAAgAAiAAgAA0AAAAAAAAAAAQAAAAAAAAAAIVCAAAACEAAAAAPwDDLAGAAAAAAAAAAAAicAwQAAAAIBgYAEAAABBAAAAAAQAAQAAAAAAAAAACAmQAAAIAAAAAAAQAAAAAAAAIiCEIAAQoICABQEACAAAAAsAAAAAABoFBiQAAAAAAAAFAAAAIAAIAiGAAAAABAAAAAoQACAAgCBAAAEARlAAAIkOEQAACAYAAAgAAQAAAAAgAABAAAAAAAAAAIgAgAAACUAAAACAJADAAAEAAgAAANABEHiAIQUFAAAAAAAAAAAAAAAAAAAAAAAAAAAABFAAu5AKAiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCTwEAAAAAAIDF/d%3D1/ed%3D1/dg%3D0/br%3D1/ujg%3D1/rs%3DACT90oE9QiPz3foI1coJOv-5ol3O7L107g?cb%3D121509378,_fmt:prog,_id:_MZHDaoLNEbH_7_UP--jJ2AI_18&amp;sp_imghp=false&amp;sp_hpep=2&amp;sp_hpte=0&amp;vet=10ahUKEwjCqdnx6aKXAxWx_7sIHXt0EisQj-0KCCU..i</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/client_204?atyp=i&amp;biw=1920&amp;bih=1080&amp;dpr=1&amp;ei=MZHDaoLNEbH_7_UP--jJ2AI&amp;opi=89978449</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/client_204?cs=1&amp;opi=89978449</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/complete/s?q&amp;cp=0&amp;client=gws-wiz&amp;xssi=t&amp;gs_pcrt=2&amp;hl=de&amp;authuser=0&amp;psi=MZHDaoLNEbH_7_UP--jJ2AI.1791201585672&amp;dpr=1&amp;nolsbt=1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/complete/s?q&amp;cp=0&amp;client=gws-wiz-desktop-aim&amp;xssi=t&amp;gs_pcrt=4&amp;hl=de&amp;authuser=0&amp;psi=MZHDaoLNEbH_7_UP--jJ2AI.1791201585672&amp;dpr=1&amp;nolsbt=1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/gen_204?atyp=csi&amp;ei=MZHDaoLNEbH_7_UP--jJ2AI&amp;s=promo&amp;rt=hpbas.329&amp;zx=1791201585699&amp;opi=89978449</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/gen_204?atyp=csi&amp;ei=MZHDaoLNEbH_7_UP--jJ2AI&amp;s=promo&amp;rt=hpbas.329,hpbarr.2&amp;zx=1791201585700&amp;opi=89978449</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/gen_204?atyp=csi&amp;ei=MZHDaoLNEbH_7_UP--jJ2AI&amp;s=webhp&amp;t=all&amp;folr=_MZHDaoLNEbH_7_UP--jJ2AI_18&amp;imn=8&amp;dtc=199&amp;stc=50&amp;ima=0&amp;imad=0&amp;imac=2&amp;wh=1080&amp;nt=navigate&amp;dt=&amp;ts=88178&amp;nhp=h3&amp;ant=push&amp;tbdba=0&amp;tbdaa=0&amp;thdba=0&amp;thdaa=0&amp;ime=1&amp;imeh=0&amp;imeha=0&amp;imehb=0&amp;imea=0&amp;imeb=0&amp;imel=0&amp;imed=0&amp;imeeb=0&amp;imexb=0&amp;scp=0&amp;cb=87878&amp;ucb=288500&amp;lts=88178&amp;adh=&amp;mem=ujhs.8,tjhs.12,jhsl.4295,dm.32&amp;nv=ne.1,feid.172939c5-34db-41f1-9f05-66dee3afa05b&amp;net=dl.1500,ect.4g,rtt.100,sd.0&amp;hp=&amp;p=bs.true&amp;rt=hst.20,prt.102,aft.102,xjses.111,xjsee.256,xjs.256,wsrt.306,cst.0,dnst.0,rqst.98,rspt.11,rqstt.219,unt.218,cstt.218,dit.414&amp;zx=1791201585628&amp;opi=89978449</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/gen_204?atyp=i&amp;ct=bxjs&amp;cad=&amp;b=0&amp;ei=MZHDaoLNEbH_7_UP--jJ2AI&amp;zx=1791201585440&amp;opi=89978449</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/gen_204?atyp=i&amp;ct=psnt&amp;cad=&amp;nt=navigate&amp;ei=MZHDaoLNEbH_7_UP--jJ2AI&amp;zx=1791201585772&amp;opi=89978449</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/gen_204?atyp=i&amp;ei=MZHDaoLNEbH_7_UP--jJ2AI&amp;dt19=2&amp;prm23=0&amp;zx=1791201585840&amp;opi=89978449</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/gen_204?atyp=i&amp;ei=MZHDaoLNEbH_7_UP--jJ2AI&amp;vet=10ahUKEwjCqdnx6aKXAxWx_7sIHXt0EisQuqMJCJgB..s&amp;bl=sQbS&amp;s=webhp&amp;lpl=CAEQARgCIAEoOzAHOANiBhC-j9r6Ag&amp;zx=1791201585916&amp;opi=89978449</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/gen_204?atyp=i&amp;ei=MZHDaoLNEbH_7_UP--jJ2AI&amp;vet=10ahUKEwjCqdnx6aKXAxWx_7sIHXt0EisQuqMJCJgB..s&amp;bl=sQbS&amp;s=webhp&amp;lpl=CAEQARgCMAc4A2IGEL6P2voC&amp;zx=1791201585858&amp;opi=89978449</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/gen_204?ei=MZHDaoLNEbH_7_UP--jJ2AI&amp;sol=th&amp;atyp=i&amp;sr=10</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/gen_204?ei=MZHDaoLNEbH_7_UP--jJ2AI&amp;vet=10ahUKEwjCqdnx6aKXAxWx_7sIHXt0EisQhJAHCDg..s&amp;bl=sQbS&amp;s=webhp&amp;gl=de&amp;pc=SEARCH_HOMEPAGE&amp;isMobile=false</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/gen_204?s=async&amp;astyp=hpba&amp;t=all&amp;atyp=csi&amp;ei=MZHDapXFGoqjkdUPy-nQoAU&amp;rt=ipf.7,ipfr.213,ttfb.213,st.213,ipfrl.214,acrt.214,aaft.214,art.214,ns.-357&amp;twt=1&amp;mwt=1&amp;imn=0&amp;ima=0&amp;sv=&amp;cb=112&amp;ucb=102&amp;folid=_MZHDaoLNEbH_7_UP--jJ2AI_18</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/gen_204?s=webhp&amp;t=aft&amp;atyp=csi&amp;ei=MZHDaoLNEbH_7_UP--jJ2AI&amp;rt=wsrt.306,hst.20,prt.102,aft.102&amp;folr=_MZHDaoLNEbH_7_UP--jJ2AI_18&amp;imn=8&amp;dtc=199&amp;stc=50&amp;ima=0&amp;imad=0&amp;imac=2&amp;wh=1080&amp;nt=navigate&amp;dt=&amp;ts=88178&amp;nhp=h3&amp;ant=push&amp;opi=89978449</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/imghp?hl=de&amp;ogbl</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/intl/de_de/ads/</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/intl/de_de/ads/?subid=ww-ww-et-g-awa-a-g_hpafoot1_1!o2&amp;utm_source=google.com&amp;utm_medium=referral&amp;utm_campaign=google_hpafooter&amp;fg=1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/preferences?hl=de&amp;fg=1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/services/</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/services/?subid=ww-ww-et-g-awa-a-g_hpbfoot1_1!o2&amp;utm_source=google.com&amp;utm_medium=referral&amp;utm_campaign=google_hpbfooter&amp;fg=1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/setprefs?sig=0_IsiCg5i3ZjGMKDDm_uRqFJMV09A%3D&amp;hl=en&amp;source=homepage&amp;sa=X&amp;ved=0ahUKEwjCqdnx6aKXAxWx_7sIHXt0EisQ2ZgBCCg</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/shared_dict/homepage/58e80c075bf7d5a48773ea069abb39ba7c7fcdcce0d0d0f3de7916065c85650e.dict</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/webhp?hl=de&amp;ictx=0&amp;sa=X&amp;ved=0ahUKEwjCqdnx6aKXAxWx_7sIHXt0EisQPAgF</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/xjs/_/js/k=xjs.hd.de.Z2IWh1ARE_k.2023.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQECAAAAEAAAAAAAAAAAAAAAgABAAAAAAAAAAAAAAAAAAAAAAABAQIAAkAAAAAAAAAAgAAEABABAAACAAAAADAAgAAiAAAAAwAAAAAAAAAAAAAAAAAAAAAAIQCAAAACEAAAAAPwDDLACAAAAAAAAAAAACQAwAAAAAAAAYAEAAABBAAAAAAQAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAEAAAAoAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAABAAAAAoAACAAACAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAABAAAAAAAAAAAgAAAAACUAAAAAAAAAAAAAAAgAAANABEHiAIQUFAAAAAAAAAAAAAAAAAAAAAAAAAAAABFAAu5ACAiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCTwEAAAAAAIDF/d=0/dg=0/br=1/rs=ACT90oFC9DjhEfnZ2iFaAVVCjUxW3rsTVA/m=cjaPkb,Gfrscd,dZKngb,sy2hb,nWejHf,xaJoqe,sy2hd,sy27e,sy2hc,sy11x,stDGof,HLchQe,sy1hz,sy11i,sy11j,sy11h,sy21f,sy1wa,sy1w1,sy2hh,sy2hg,sy2he,sy1t9,sy27o,sy27l,sy9i,sy27m,sy27n,sygx,sy27k,sy27g,syg1,sy27j,sy1hy,sy21d,sy21e,sy1w0,sy2hf,sy20p,sy20n,sy20m,sy20l,sy20k,sy20g,sy20f,sy20e,sy1wd,sy1w4,syow,syo7,syo6,sy20j,sy20r,sy1vk,sy1vm,sy1vw,sy1vr,sy1vv,sykc,syjz,syj9,sybz,syk7,sy1vu,sy1vs,sy11f,sy1vq,DnWHof,aG3wVc,syhg,aLUfP,wQlYve,sy2gv,sy2gz,sy2h0,sy2gu,sy2h1,sy2gq,sy2gp,sy2ca,sy2gr,sy2gn,sy2gm,sy2gk,s0j7C,sy1a1,sy19s,sy19n,syjp,syjo,syiz,syhn,syiu,syfz,syc8,syc5,sy19o,SMquOb,sy98,sy97,syjf,syjc,syjd,syjb,sykq,sykp,sykm,sykl,sykk,sykf,sykg,syjv,syk6,syjt,sybw,sybt,syju,syjs,sybv,syc0,sybl,sybo,syjr,syfv,syjj,syji,syja,syj3,syj4,syj2,sycm,syho,syif,syid,syic,syib,sy9o,syi0,syie,syia,sydl,sydr,sycb,sycu,syct,sycs,sycr,sycg,sycp,sycq,sydo,sydg,sycy,sycz,sydf,syda,syd9,syd6,syco,syde,sycx,sydb,sycj,syck,sych,syd0,sycl,sydx,sycc,syc7,syc2,syc6,sycf,sydc,syi8,syi2,sye7,syis,syi9,syij,syik,syi7,syfw,syi1,sye9,syea,syeb,sye2,sye1,sydi,sye4,sydz,sye5,syce,syd5,sye0,sye8,syi5,syhw,syhy?cb=121509378&amp;xjs=s4</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/xjs/_/js/k=xjs.hd.de.Z2IWh1ARE_k.2023.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQECAAAAEAAAAAAAAAAAAAAAgABAAAAAAAAAAAAAAAAAAAAAAABAQIAAkAAAAAAAAAAgAAEABABAAACAAAAADAAgAAiAAAAAwAAAAAAAAAAAAAAAAAAAAAAIQCAAAACEAAAAAPwDDLACAAAAAAAAAAAACQAwAAAAAAAAYAEAAABBAAAAAAQAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAEAAAAoAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAABAAAAAoAACAAACAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAABAAAAAAAAAAAgAAAAACUAAAAAAAAAAAAAAAgAAANABEHiAIQUFAAAAAAAAAAAAAAAAAAAAAAAAAAAABFAAu5ACAiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCTwEAAAAAAIDF/d=0/dg=0/br=1/rs=ACT90oFC9DjhEfnZ2iFaAVVCjUxW3rsTVA/m=lOO0Vd,sya4,P6sQOc?cb=121509378&amp;xjs=s4</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/xjs/_/js/k=xjs.hd.de.Z2IWh1ARE_k.2023.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQECAAAAEAAAAAAAAAAAAAAAgABAAAAAAAAAAAAAAAAAAAAAAABAQIAAkAAAAAAAAAAgAAEABABAAACAAAAADAAgAAiAAAAAwAAAAAAAAAAAAAAAAAAAAAAIQCAAAACEAAAAAPwDDLACAAAAAAAAAAAACQAwAAAAAAAAYAEAAABBAAAAAAQAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAEAAAAoAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAABAAAAAoAACAAACAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAABAAAAAAAAAAAgAAAAACUAAAAAAAAAAAAAAAgAAANABEHiAIQUFAAAAAAAAAAAAAAAAAAAAAAAAAAAABFAAu5ACAiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCTwEAAAAAAIDF/d=0/dg=0/br=1/rs=ACT90oFC9DjhEfnZ2iFaAVVCjUxW3rsTVA/m=qTnoBf,syal,sOXFj,oGtAuc,NJ1rfe,syau,q0xTif,y05UD,sysj,sy2df,sy1iw,syqp,sysw,sy2db,sy21l,sy2dc,sy2d8,sy2d6,sy2bi,sy2bj,sy1hr,sy1in,sy1i1,sy1io,sy1cy,sy1h7,sy1h9,sy1hb,sy1hc,epYOx?cb=121509378&amp;xjs=s4</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/xjs/_/js/k=xjs.hd.de.Z2IWh1ARE_k.2023.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQECAAAAEAAAAAAAAAAAAAAAgABAAAAAAAAAAAAAAAAAAAAAAABAQIAAkAAAAAAAAAAgAAEABABAAACAAAAADAAgAAiAAAAAwAAAAAAAAAAAAAAAAAAAAAAIQCAAAACEAAAAAPwDDLACAAAAAAAAAAAACQAwAAAAAAAAYAEAAABBAAAAAAQAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAEAAAAoAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAABAAAAAoAACAAACAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAABAAAAAAAAAAAgAAAAACUAAAAAAAAAAAAAAAgAAANABEHiAIQUFAAAAAAAAAAAAAAAAAAAAAAAAAAAABFAAu5ACAiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCTwEAAAAAAIDF/d=0/dg=0/br=1/rs=ACT90oFC9DjhEfnZ2iFaAVVCjUxW3rsTVA/m=sy2gi,sy2gh,nNxkYd,sy2h7,sy217,sy20d,sy1w3,sy2h6,sy2h3,sy2h5,sy2h4,sy2g6,sy11y,nTNfhe,sy2fu,P10Owf,sy1a2,gSZvdb,sy19g,sy19e,syp2,sys4,CnSW2d,sy19b,sy198,sy192,sy19a,sy193,nRwWne,sy19d,fXO0xe?cb=121509378&amp;xjs=s4</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/xjs/_/js/k=xjs.hd.de.Z2IWh1ARE_k.2023.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQECAAAAEAAAAAAAAAAAAAAAgABAAAAAAAAAAAAAAAAAAAAAAABAQIAAkAAAAAAAAAAgAAEABABAAACAAAAADAAgAAiAAAAAwAAAAAAAAAAAAAAAAAAAAAAIQCAAAACEAAAAAPwDDLACAAAAAAAAAAAACQAwAAAAAAAAYAEAAABBAAAAAAQAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAEAAAAoAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAABAAAAAoAACAAACAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAABAAAAAAAAAAAgAAAAACUAAAAAAAAAAAAAAAgAAANABEHiAIQUFAAAAAAAAAAAAAAAAAAAAAAAAAAAABFAAu5ACAiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCTwEAAAAAAIDF/d=0/dg=0/br=1/rs=ACT90oFC9DjhEfnZ2iFaAVVCjUxW3rsTVA/m=sy2ht,sy2ho,sy2hn,sy2hm,sy2hk,sy265,sy2hl,sy2hp,sy2hs,sy16r,sy2hj,syug,sy105,r8E4Ze?cb=121509378&amp;xjs=s4</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/xjs/_/js/k=xjs.hd.de.Z2IWh1ARE_k.2023.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQECAAAAEAAAAAAAAAAAAAAAgABAAAAAAAAAAAAAAAAAAAAAAABAQIAAkAAAAAAAAAAgAAEABABAAACAAAAADAAgAAiAAAAAwAAAAAAAAAAAAAAAAAAAAAAIQCAAAACEAAAAAPwDDLACAAAAAAAAAAAACQAwAAAAAAAAYAEAAABBAAAAAAQAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAEAAAAoAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAABAAAAAoAACAAACAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAABAAAAAAAAAAAgAAAAACUAAAAAAAAAAAAAAAgAAANABEHiAIQUFAAAAAAAAAAAAAAAAAAAAAAAAAAAABFAAu5ACAiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCTwEAAAAAAIDF/d=0/dg=0/br=1/rs=ACT90oFC9DjhEfnZ2iFaAVVCjUxW3rsTVA/m=syht,syj1,syj0,syiy,syiv,syhm,syhk,sy9u,uxMpU,syhb,syeu,syev,syet,syes,syad,syaa,sya9,sya8,sya7,sya6,Mlhmy,QGR0gd,PoEs9b,Pjplud,OTA3Ae,sya3,sy9y,A1yn5d,YIZmRd,sy9m,sy9g,sy9f,sy9c,sy9b,byfTOb,lsjVmc,LEikZe,sy99,kWgXee,ovKuLd,sgY6Zb,qafBPd,ebZ3mb,dowIGb,sy2dp,sy1a6,syg3,d5EhJe,sy2eg,fCxEDd,sy2e2,sy2e3,sy2ea,sy2e4,syg2,syg0,syfy,syby,sybx,sybm,sybc,syba,syfx,syfu,sy2e6,sy2e0,syfs,sy2e9,sy2e8,sy1uh,sy2dy,sy1da,sy1ta,sy1a9,sy1a4,sy1aa,sy19v,sy19u,sy1ab,T1HOxc,LFk59d,sy2dv,sy2du,sy2ds,sy2dt,sy2dr,sys9,zx30Y,sy2ei,sy2eh,sy19q,sy11a,Wo3n8,ZgGg9b,dIoSBb,sy2rd,b6knsb,sy2ra,sy2r9,sy2l4,sy2lc,sy114,sy2i8,syu9,syst,syql,sy197,sy2lb,sy2f5,sy195,sygi,syel,syej,syb4,syen,JKoKVe,pXdRYb,sy3w1,syb5,syb2,syb1,sy9s,O1Gjze,TtcOte,wR5FRb,sygg,sygd,syg9,syg8,sydd,syg7,syee,syg6,syg5,syg4,syfr,syfq,syfe,syfo,syf1,syeq,syer,syfn,syd4,syfc,syfl,syfb,syfj,syfa,syfi,syew,syey,syeo,syf9,syfg,syf8,syff,syf7,syf6,syf5,syf3,syf2,syf0,syez,syfd,syep,syei,syed,syb9,sy93,zbML3c,gskBEc,sy2d1,s980lf,sy1ai,sy1ag,zGLm3b,sy4aw,sy4au,sy4at,sy3ua,sy1te,sy1tf,DhPYme,sy4b5,sy3tt,sy3tr,syks,sy3ty,sy3ts,sy3u0,sy3to,sy4b4,KHourd,sy4cf,sy17w,sy11r,oQfbDd?cb=121509378&amp;xjs=s4</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/xjs/_/js/k=xjs.hd.de.Z2IWh1ARE_k.2023.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQECAAAAEAAAAAAAAAAAAAAAgABAAAAAAAAAAAAAAAAAAAAAAABAQJAAkAAAAAAAAAAgAAEABABAAACAAAAADAAgAAiAAgAAwAAAAAAAAAAAAAAAAAAAAAAIQCAAAACEAAAAAPwDDLACAAAAAAAAAAAACQAwAAAAAAAAYAEAAABBAAAAAAQAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAEAAAAoAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAABAAAAAoAACAAACAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAABAAAAAAAAAAAgAAAAACUAAAAAAAAAAAAAAAgAAANABEHiAIQUFAAAAAAAAAAAAAAAAAAAAAAAAAAAABFAAu5AKAiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCTwEAAAAAAIDF/d=1/ed=1/dg=4/br=1/rs=ACT90oFG2Yc-HxNdHvtvUTR6POSDQxaoOg/ee=ALeJib:B8gLwd;AfeaP:TkrAjf;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;BuJtU:v6yjN;CIZTGb:Kqhykb;CxXAWb:YyRLvc;DQEued:Fevhcf;DULqB:RKfG5c;Dkk6ge:JZmW9e;DpcR3d:zL72xf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EjXHpb:pSHqh;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;F54IAe:ZgsFh;F9mqte:UoRcbe;FSxmUe:fiZR8b;Fkukfc:i8H2c;Fmv9Nc:O1Tzwc;G0KhTb:LIaoZ;GleZL:J1A7Od;HMDDWe:G8QUdb;HtPxrd:Gx8jAb;IBADCc:RYquRb;IoGlCf:b5lhvb;IsdWVc:qzxzOb;JXJSm:ii1RGf;JXS8fb:Qj0suc;JqSq7d:y9ePhe;JsbNhc:Xd8iUd;K08hxe:zmbGlf;K5nYTd:ZDZcre;KA3P2:C3JnCe;KDb6nb:fE9n2;KOxcK:OZqGte;KQzWid:ZMKkN;KdIHef:BWtNj;KpRAue:Tia57b;LBgRLc:SdcwHb,XVMNvd;LBn8Cf:bJ9L0c;LEikZe:byfTOb,lsjVmc;LXA8b:q7OdKd;LsNahb:ucGLNb;MNkAde:KMCd1d;NJ1rfe:qTnoBf;NPKaK:SdcwHb;NSEoX:lazG7b;NjIwef:YVgi7d;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OIfWUb:qfOYcd;OgagBe:cNTe0;OiqE2c:TFpEK;OoK5v:Sp69O;OohIYe:mpEAQb;Pjplud:PoEs9b;PpTLXd:pJYjx;Q1Ow7b:x5CSu;Q7iJ9c:bVLZ3d;QE20Be:gIltO;QFOGlf:PQ2Aoe;QGR0gd:Mlhmy;QYLF2b:pAQYUd;Qk7yid:BbYS0d;Qw8Feb:jpavUe;R4IIIb:QWfeKf;R9Ulx:CR7Ufe;RCF5Sd:X1kBmd;RZKicf:PQXVv;Raf5me:mgvFMc;SFghJd:YRZpK;SLtqO:Kh1xYe;SMDL4c:fTfGO;SNUn3:ZwDk9d,xD8Kp;SNk4Je:wWMhg;ScI3Yc:e7Hzgb,e7Hzgb;ShpF6e:N0pvGc;Snahre:mGCtob;SzQQ3e:dNhofb;TIUVQd:lWTJwd;TroZ1d:vVVzjb;U96pRd:FsR04;UBKJZ:LGDJGb;UDrY1c:N0F29d,W50NVd,eps46d,wciyUe;UVmjEd:EesRsb;UVzb9c:IvPZ6d;UYRIEb:HzTAQc;UyG7Kb:wQd0G;V2HTTe:RolTY;VGRfx:VFqbr;VMuEm:pL7sBc;VN6jIc:ddQyuf;VOcgDe:YquhTb;VhA7bd:vAmQFf;VsAqSb:PGf2Re;W9QSQe:ynCWwc;WDGyFe:jcVOxd;WXtNeb:QU9BMd;Wfmdue:g3MJlb;Wl55ib:vgbiKb;Y3c5sd:FGbfLe;YIZmRd:A1yn5d;YV5bee:IvPZ6d;YnHUBf:sNsSob;ZSH6tc:QAvyLe;ZWEUA:afR4Cf;ZlOOMb:P0I0Ec;a56pNe:JEfCwb;aAJE9c:WHW6Ef;aCJ9tf:qKftvc;aVZq3e:EMeVIb;aZ61od:arTwJ;aci7y:Z5Tr6c;bUIkwb:WMwEHe;bcPXSc:gSZLJb;cEt90b:ws9Tlc;cFTWae:gT8qnd;dIoSBb:ZgGg9b;dLlj2:Qqt3Gf;dXdZV:a7QTqd;dowIGb:ebZ3mb,ebZ3mb;dtl0hd:lLQWFe;eBAeSb:Ck63tb;eBZ5Nd:audvde;eHDfl:ofjVkb;eJKchc:ATg1be;eO3lse:UefOmb;euOXY:OZjbQ;g8nkx:U4MzKc;gaub4:TN6bMe;gbfHR:qZtzib;gtVSi:ekUOYd;h3MYod:ws9Tlc;hK67qb:QWEO5b;hVic1b:Kqhykb;heHB1:sFczq;hjRo6e:F62sG;hlqGX:FWz1ic;hsLsYc:Vl118;hwoVHd:zw4U8c;iFQyKf:QIhFr;jJj2G:kF2o2b;k1O0rf:pnOULd;k2Qxcb:XY51pe;kbAm9d:MkHyGd;lOO0Vd:OTA3Ae;lbfkyf:MqGdUd;liAz7d:kF2o2b;mMVOGb:qDM7K;mWzs9c:fz5ukf;mtKMCc:ZG5Tfe;nBZnZe:CvErjb;nE6OJf:Fi4rsc;nEBWNb:MxKX9d;nJw4Gd:dPFZH;nrDcw:SuEoDe;oGtAuc:sOXFj;oSUNyd:fTfGO,fTfGO;oUlnpc:RagDlc;oiBhre:OuMkRd;okUaUd:wItadb;pKJiXd:VCenhc;pNsl2d:j9Yuyc;pXdRYb:JKoKVe;pj82le:ww04Df;qGV2uc:HHi04c;qQEoOc:KUM7Z,d7YSfd;qZx2Fc:j0xrE;qaS3gd:yiLg6e;qafBPd:sgY6Zb;qavrXe:I0C9u;qddgKe:d7YSfd,x4FYXe;rdexKf:FEkKD;rmWaj:PMS6Sd;ropkZ:hjoqoe;sTsDMc:JksfDf;sZmdvc:rdGEfc;tH4IIe:Ymry6;teSRSb:BMLai;tosKvd:ZCqP3;trZL0b:qY8PFe;uJfyCe:WJ5gBc;uuQkY:u2V3ud;vEYCNb:FaqsVd;vRlMvf:Iw9Xo;vfVwPd:lcrkwe;w3bZCb:ZPGaIb;w9w86d:XwhUEb,dt4g2b,gKD90c,lWVZVe;wFpbG:JbGbBc;wQlYve:aLUfP;wR5FRb:O1Gjze,TtcOte;wV5Pjc:L8KGxe;wxAT5b:tHKmqf;x9N9ie:KH4Qof;xBbsrc:NEW1Qc;xpaRob:AVqZ9b;yiL5Ab:MT0ZBd;ysNiMc:CpIBjd;yxTchf:KUM7Z;z97YGf:oug9te;zaIgPb:Sl0pxd/m=cdos,hsm,jsa,mb4ZUb,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl,YV5bee,d,csi?cb=121509378</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/xjs/_/js/k=xjs.hd.de.Z2IWh1ARE_k.2023.O/ck=xjs.hd.5xbvnRzz1h4.L.B1.O/am=AAAEAAAgAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQBAUAAAAAQECAAQAkAgAAABAAAAAAAAA4QBAAIABAAAAAACAAAAAAAAAAABAQJAAkAAAAAAAAAAgAAEADABAAACACAAADAAgAAiAAgAA0AAAAAAAAAAAQAAAAAAAAAAIVCAAAACEAAAAAPwDDLAGAAAAAAAAAAAAicAwQAAAAIBgYAEAAABBAAAAAAQAAQAAAAAAAAAACAmQAAAIAAAAAAAQAAAAAAAAIiCEIAAQoICABQEACAAAAAsAAAAAABoFBiQAAAAAAAAFAAAAIAAIAiGAAAAABAAAAAoQACAAgCBAAAEARlAAAIkOEQAACAYAAAgAAQAAAAAgAABAAAAAAAAAAIgAgAAACUAAAACAJADAAAEAAgAAANABEHiAIQUFAAAAAAAAAAAAAAAAAAAAAAAAAAAABFAAu5AKAiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCTwEAAAAAAIDF/d=0/dg=0/br=1/ujg=1/rs=ACT90oE9QiPz3foI1coJOv-5ol3O7L107g/m=sy10h,sy10c,HGv0mf,V8UGT,S37m2c,UEShwc,sy199,YHnUBc,sy2g5,sy2g1,VtMfj,rPoQob,j4oDHb,VIsItc,O921Td,oSkQOe,DoXgpb,entfIc,dY0tuc,yyRyad,m1ttTd,i2R6yd,GO95Vb,NZ3mjb,sysk,sy21z,sy21y,n8YO7e,sy22k,sy22h,syl4,syl7,sy22g,syl5,sy22f,syny,sy22e,sy1yo,sy1it,sy1iu,sy1iy,sy1ii,sy1id,sy1ie,sy1ib,sy1d3,sy1hw,sy1fj,sy1d7,sy1d6,sy1d5,sy1d4,sy1d2,sy1d0,syci,sy1ia,sy1i8,sy1i9,sy1hv,sy1i7,sy1i3,sy1fd,sy1i2,sy1hx,sy1ic,sy1hu,sy1i6,sy1hs,sy1i4,sy1g0,sy11k,sy22i,jywEkf,U9EYge,sy131,loL8vb,sy148,sy147,sy13h,sy13b,sy13i,sy143,sydt,sydu,sydn,sy146,sy13f,sy13d,sy13c,syhi,sy13a,sy142,sy140,sy13z,sy13y,sy13x,syir,syhj,syhh,syec,sy141,sy144,sy13g,sy13m,sy133,sy145,sy13v,sy13u,sy13o,sy13t,sy13p,sy13l,sy13k,sy13j,sy135,sy12r,sy11m,sy11l,sy136,ms4mZb,sy106,B2qlPe,sy190,NzU6V,sy19i,sy9r,WlNQGd,sy12q,sy12o,sy12n,DPreE,sy19k,sy19j,nabPbb,abd,sy4c3,TDFkye?cb=121509378&amp;xjs=s3</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/xjs/_/js/k=xjs.hd.de.Z2IWh1ARE_k.2023.O/ck=xjs.hd.5xbvnRzz1h4.L.B1.O/am=AAAEAAAgAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQBAUAAAAAQECAAQAkAgAAABAAAAAAAAA4QBAAIABAAAAAACAAAAAAAAAAABAQJAAkAAAAAAAAAAgAAEADABAAACACAAADAAgAAiAAgAA0AAAAAAAAAAAQAAAAAAAAAAIVCAAAACEAAAAAPwDDLAGAAAAAAAAAAAAicAwQAAAAIBgYAEAAABBAAAAAAQAAQAAAAAAAAAACAmQAAAIAAAAAAAQAAAAAAAAIiCEIAAQoICABQEACAAAAAsAAAAAABoFBiQAAAAAAAAFAAAAIAAIAiGAAAAABAAAAAoQACAAgCBAAAEARlAAAIkOEQAACAYAAAgAAQAAAAAgAABAAAAAAAAAAIgAgAAACUAAAACAJADAAAEAAgAAANABEHiAIQUFAAAAAAAAAAAAAAAAAAAAAAAAAAAABFAAu5AKAiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCTwEAAAAAAIDF/d=0/dg=0/br=1/ujg=1/rs=ACT90oE9QiPz3foI1coJOv-5ol3O7L107g/m=sy2ol,sy1vn,sy4cm,ifl?cb=121509378&amp;xjs=s3</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/xjs/_/js/md=2/k=xjs.hd.de.Z2IWh1ARE_k.2023.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQECAAAAEAAAAAAAAAAAAAAAgABAAAAAAAAAAAAAAAAAAAAAAABAQJAAkAAAAAAAAAAgAAEABABAAACAAAAADAAgAAiAAgAAwAAAAAAAAAAAAAAAAAAAAAAIQCAAAACEAAAAAPwDDLACAAAAAAAAAAAACQAwAAAAAAAAYAEAAABBAAAAAAQAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAEAAAAoAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAABAAAAAoAACAAACAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAABAAAAAAAAAAAgAAAAACUAAAAAAAAAAAAAAAgAAANABEHiAIQUFAAAAAAAAAAAAAAAAAAAAAAAAAAAABFAAu5AKAiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCTwEAAAAAAIDF/rs=ACT90oFG2Yc-HxNdHvtvUTR6POSDQxaoOg?cb=121509378</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/xjs/_/ss/k=xjs.hd.5xbvnRzz1h4.L.B1.O/am=AAAEAAAgAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQBAUAAAAAAAAAAQAgAgAAABAAAAAAAAA4QAAAIABAAAAAACAAAAAAAAAAAAAABAAkAAAAAAAAAAgAAEADAAAAACACAAAAAAgAAiAAgAAEAAAAAAAAAAAQAAAAAAAAAAIFCAAAAAAAAAAAAAAAIAEAAAAAAAAAAAAgMAwQAAAAIBgAAAAAAAAAAAAAAAAAAAAAAAAAAAACAmQAAAIAAAAAAAQAAAAAAAAIiCEIAAQoICABQEAAAAAAAsAAAAAABoFBiQAAAAAAAAEAAAAIAAIAiGAAAAABAAAAAAQACAAgABAAAEARlAAAIkOEQAACAQAAAgAAQAAAAAgAAAAAAAAAAAAAIgAgAAAAAAAAACAJADAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK/d=0/br=1/rs=ACT90oEGTIB-OFdQYoBzngAjIiPeG7oXNA/m=cjaPkb,syow,syo7,syo6,aG3wVc,sys9,syu9,syst,syql,sy197?cb=121509378&amp;xjs=s4</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/xjs/_/ss/k=xjs.hd.5xbvnRzz1h4.L.B1.O/am=AAAEAAAgAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQBAUAAAAAAAAAAQAgAgAAABAAAAAAAAA4QAAAIABAAAAAACAAAAAAAAAAAAAABAAkAAAAAAAAAAgAAEADAAAAACACAAAAAAgAAiAAgAAEAAAAAAAAAAAQAAAAAAAAAAIFCAAAAAAAAAAAAAAAIAEAAAAAAAAAAAAgMAwQAAAAIBgAAAAAAAAAAAAAAAAAAAAAAAAAAAACAmQAAAIAAAAAAAQAAAAAAAAIiCEIAAQoICABQEAAAAAAAsAAAAAABoFBiQAAAAAAAAEAAAAIAAIAiGAAAAABAAAAAAQACAAgABAAAEARlAAAIkOEQAACAQAAAgAAQAAAAAgAAAAAAAAAAAAAIgAgAAAAAAAAACAJADAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK/d=0/br=1/rs=ACT90oEGTIB-OFdQYoBzngAjIiPeG7oXNA/m=sy2gh,syp2,sys4?cb=121509378&amp;xjs=s4</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/xjs/_/ss/k=xjs.hd.5xbvnRzz1h4.L.B1.O/am=AAAEAAAgAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQBAUAAAAAAAAAAQAgAgAAABAAAAAAAAA4QAAAIABAAAAAACAAAAAAAAAAAAAABAAkAAAAAAAAAAgAAEADAAAAACACAAAAAAgAAiAAgAAEAAAAAAAAAAAQAAAAAAAAAAIFCAAAAAAAAAAAAAAAIAEAAAAAAAAAAAAgMAwQAAAAIBgAAAAAAAAAAAAAAAAAAAAAAAAAAAACAmQAAAIAAAAAAAQAAAAAAAAIiCEIAAQoICABQEAAAAAAAsAAAAAABoFBiQAAAAAAAAEAAAAIAAIAiGAAAAABAAAAAAQACAAgABAAAEARlAAAIkOEQAACAQAAAgAAQAAAAAgAAAAAAAAAAAAAIgAgAAAAAAAAACAJADAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK/d=0/br=1/rs=ACT90oEGTIB-OFdQYoBzngAjIiPeG7oXNA/m=syug,sy105?cb=121509378&amp;xjs=s4</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/xjs/_/ss/k=xjs.hd.5xbvnRzz1h4.L.B1.O/am=AAAEAAAgAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQBAUAAAAAAAAAAQAgAgAAABAAAAAAAAA4QAAAIABAAAAAACAAAAAAAAAAAAAABAAkAAAAAAAAAAgAAEADAAAAACACAAAAAAgAAiAAgAAEAAAAAAAAAAAQAAAAAAAAAAIFCAAAAAAAAAAAAAAAIAEAAAAAAAAAAAAgMAwQAAAAIBgAAAAAAAAAAAAAAAAAAAAAAAAAAAACAmQAAAIAAAAAAAQAAAAAAAAIiCEIAAQoICABQEAAAAAAAsAAAAAABoFBiQAAAAAAAAEAAAAIAAIAiGAAAAABAAAAAAQACAAgABAAAEARlAAAIkOEQAACAQAAAgAAQAAAAAgAAAAAAAAAAAAAIgAgAAAAAAAAACAJADAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK/d=0/br=1/rs=ACT90oEGTIB-OFdQYoBzngAjIiPeG7oXNA/m=y05UD,sysj,sy2df,sy1iw,syqp,sysw,sy2db,sy2d8,sy1hr,sy1in,sy1cy,sy1h7,sy1hb,epYOx?cb=121509378&amp;xjs=s4</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/xjs/_/ss/k=xjs.hd.5xbvnRzz1h4.L.B1.O/am=AAAEAAAgAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQBAUAAAAAAAAAAQAgAgAAABAAAAAAAAA4QAAAIABAAAAAACAAAAAAAAAAAAAABAAkAAAAAAAAAAgAAEADAAAAACACAAAAAAgAAiAAgAAEAAAAAAAAAAAQAAAAAAAAAAIFCAAAAAAAAAAAAAAAIAEAAAAAAAAAAAAgMAwQAAAAIBgAAAAAAAAAAAAAAAAAAAAAAAAAAAACAmQAAAIAAAAAAAQAAAAAAAAIiCEIAAQoICABQEAAAAAAAsAAAAAABoFBiQAAAAAAAAEAAAAIAAIAiGAAAAABAAAAAAQACAAgABAAAEARlAAAIkOEQAACAQAAAgAAQAAAAAgAAAAAAAAAAAAAIgAgAAAAAAAAACAJADAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK/d=1/ed=1/br=1/rs=ACT90oEGTIB-OFdQYoBzngAjIiPeG7oXNA/m=cdos,hsm,jsa,mb4ZUb,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl,YV5bee,d,csi?cb=121509378</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.de/intl/de/about/products</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/images/branding/searchlogo/ico/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/og/_/js/k=og.asy.en_US.L5WDNrI5X14.2019.O/rt=j/m=_ac,_awd,ada,lldp,qads,abld/exm=/d=1/ed=1/rs=AA2YrTujYGdgteLglOIkjkXtxbFPLASt5A</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/og/_/ss/k=og.asy.rgE7U-O-MoE.L.W.O/m=ll_tdm,adcgm3,ll_fw,abld/excm=/d=1/ed=1/ct=zgms/rs=AA2YrTs8gbyCCJLiqdTVQgamLKyE7-tmqA</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.com/?q=devoko+divano+chaise+longuwe&amp;page=1&amp;ec=futura_exp_og_so_72776762_e</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/?q=devoko+divano+chaise+longuwe&amp;page=1&amp;gl=DE&amp;m=0&amp;pc=shp&amp;cm=5&amp;hl=de&amp;src=4</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>xjs.hd.de</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>about.google</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>accounts.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>consent.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>lh3.googleusercontent.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>ogads-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ogs.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>policies.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.de</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.gstatic.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>about.google</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>accounts.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>consent.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>google.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>mail.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ogads-pa.clients6.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>play.google.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>policies.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>store.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>support.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>sustainability.google</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.de</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.13.94</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.94</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.14.102</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.154.119</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.14.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.154.119</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.84</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>216.239.32.29</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.132</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>3e33d6bcec475474f7242928c9fb27c378819cd28a5b636b54129078f6db50f9</SHA-256>
              <SHA-1>224e4fdb4d9e7579747c1c851d7a014f638cb745</SHA-1>
              <MD5>4d0b1ccc2d4bc68240f03e629b84dce0</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>13a65b2e2a08f40f41108c194e5d0f4bb7820bbf088c1d8876c3766a5da0a611</SHA-256>
              <SHA-1>2422ec096719156514d72407b1a5220462534b42</SHA-1>
              <MD5>0fee3da7240433156a799848d48ccea5</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>64fd2f04b589b51888a380b3816bb4cec820ed5093b9dafeac591b52cd96222e</SHA-256>
              <SHA-1>9d2e9304a90b611d3557bcff2aea24d00c0bc358</SHA-1>
              <MD5>5314c6d76df361eef7c14f4ef5e9210f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>593e5394f59875138d4b7e009ff26d66939fa38b8787cc4bc14e42a72f82a39d</SHA-256>
              <SHA-1>91b0a804b7d1444de28495d6ec6ec08e11414287</SHA-1>
              <MD5>9c9f5c5016afb6bc877ec9dd93d9dc4a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>48baa95a59fa087804aeab840af1abf9ced4d1e73a5279a746ad419b173dfacc</SHA-256>
              <SHA-1>3eb4909882b70a2cfd2d2adb06ce9ce2dae90a17</SHA-1>
              <MD5>6e365569588f9671d7986c7a37a99df5</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>8a3b5c677d98704a893b0f420a0cc7404fb1424eed4d9616fca116f9781c97f7</SHA-256>
              <SHA-1>648d56768287d68d26fe7bfb2fdf7666364569fc</SHA-1>
              <MD5>070bf197bb67e6fb09bbbf76b8c752b1</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>cdfbdb29e651667bed8461148108ada6bedfd4c41732e575d066f76d55c883a6</SHA-256>
              <SHA-1>7335fa2e0dd1c87505f15dbe811033883a77fca4</SHA-1>
              <MD5>e0eba80559394b6662ab3a935fa0e0d8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>e328909315604e94f467fb0004d4a49d161418048f592d88c50c0ec14757590b</SHA-256>
              <SHA-1>dfab1fdb74530471136c39459986aa31644315c9</SHA-1>
              <MD5>59d59f0c83c6f0d304d9755bcaed3098</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>25b56ba2f7f770edc85e856c9fb366badc84c475181f3c2ca197dc301c837f4c</SHA-256>
              <SHA-1>06120393bce882e6e61a5e097bbc156485cee6ec</SHA-1>
              <MD5>a3992b911cb2db482a5bb6db884d2e60</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>c1d85e0a1158dc261a86c6e50545153b1ace1caca5aa263320febae3db329416</SHA-256>
              <SHA-1>fc4f4aad075039b6fbfb8bdd2955e09ee2cd6ed3</SHA-1>
              <MD5>af5408374a6c2f30f0c5738dc25eb760</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://nordichomeix.com/search?q=devoko%20divano%20chaise%20longuwe&amp;page=1</name>
        <report_id>a443a648-9edb-487f-aa86-3f77af8c0ac6</report_id>
        <tags>
          <value>html</value>
          <value>png</value>
          <value>base64</value>
          <value>obfuscated</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0405294a4fa27c2d4466623b8549a339366e232dc3bf17e724975ef2cc200da9</id>
    <title>Analysis Report for 0405294a4fa27c2d4466623b8549a339366e232dc3bf17e724975ef2cc200da9</title>
    <updated>2026-10-05T11:59:14Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3911ed130e7ad45267611</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6ac39111766af099f2b3a2d8</flow_id>
        <hash>0405294a4fa27c2d4466623b8549a339366e232dc3bf17e724975ef2cc200da9</hash>
        <iocs>
          <urls>
            <value>
              <url>http://purenetworks.com/HNAP1</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://schemas.xmlsoap.org/soap/encoding</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://schemas.xmlsoap.org/soap/envelope</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2001/XMLSchema</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2001/XMLSchema-instance</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>purenetworks.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schemas.xmlsoap.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>w3.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>127.0.0.1</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>176.65.139.139</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.168.0.100</ip>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <ip>255.255.255.255</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.22.19</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>9c66f88b79ad60d6d5b63839bbb709b0cdfd591898c35ac187c3c272c47b52ae</SHA-256>
              <SHA-1>88f62ae3ca8827e50a463322427d3bc8edeb378e</SHA-1>
              <MD5>fab4aa3bc10fe3020538e90252e9b8f3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>b77d77ae19836e21914c676730ede7269bc4907496470c692dfef85eee0e34cc</SHA-256>
              <SHA-1>d59d245e51c74ddca6765f14b8b7981af3800a00</SHA-1>
              <MD5>35ed02ac4ec6ea5c7590d2e97ddd56e7</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>09576451eacb2e792f9c6c65a9285017f5950707a3462c5aedeff12def134fc1</SHA-256>
              <SHA-1>6d8346604b85ac9b5903b1cdcfd20407e813cc1b</SHA-1>
              <MD5>f3119adb69e9839d55f37f1ded752cdf</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>d2487bc0707dcb345eed3b65978593cdeb9dee8026d12ff6d6436109f77c6196</SHA-256>
              <SHA-1>8196b95261d6b7c3c4a32e141c7a6ac2b76a8ce5</SHA-1>
              <MD5>83abcbb3bfe28d66cdcc11c5da9fe446</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>main_x86.elf</name>
        <report_id>d9431b2c-4108-45f1-a5fd-7a489880f897</report_id>
        <tags>
          <value>elf</value>
          <value>html</value>
          <value>xml</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e14602d3a459e940f0d0ecfd0942557013721c9502c841a53a20f7417cdb296e</id>
    <title>Analysis Report for e14602d3a459e940f0d0ecfd0942557013721c9502c841a53a20f7417cdb296e</title>
    <updated>2026-10-05T11:58:44Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39110d130e7ad4526760d</_id>
        <file_type>application/vnd.ms-outlook</file_type>
        <flow_id>6ac390f2dedbc9646d41c4ab</flow_id>
        <hash>e14602d3a459e940f0d0ecfd0942557013721c9502c841a53a20f7417cdb296e</hash>
        <iocs>
          <urls>
            <value>
              <url>http://www.promopharma.it/&amp;data=05</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>https://www.facebook.com/Promopharma/&amp;data=05</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/promo.pharma/&amp;data=05</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/promopharma/&amp;data=05</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>https://www.promopharma.it/cdn/shop/files/promopharma_logo.png&amp;data=05</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.promopharma.it%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867367412%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=Bvv7T7Loq8fherJobDzdyAm26jI0IdqyLhs7qdb%2FTBo%3D&amp;reserved=0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.promopharma.it%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867384920%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=RaN6L8ii1FZC3MKlkGJ%2B5GViskE6I2ZMzO2CLJnVzoQ%3D&amp;reserved=0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.facebook.com%2FPromopharma%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867400601%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=mizukqoDbc0EWUojO0mJCp58gajL8PS9kCWamxs939Y%3D&amp;reserved=0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.instagram.com%2Fpromo.pharma%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867414451%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=cI2kO6HvuWbowQc9HLielWh72a2nT716ui5AGxo0vog%3D&amp;reserved=0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fpromopharma%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.promopharma.it%2Fcdn%2Fshop%2Ffiles%2Fpromopharma_logo.png&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867344136%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=hh76V%2Fnj%2BoJm5dJRmaVdedJq%2BLjjECkOG93v90RzW24%3D&amp;reserved=0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.promopharma.it/&amp;data=05</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://www.facebook.com/Promopharma/&amp;data=05</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://www.instagram.com/promo.pharma/&amp;data=05</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/promopharma/&amp;data=05</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://www.promopharma.it/cdn/shop/files/promopharma_logo.png&amp;data=05</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://schema.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.promopharma.it%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C63926540986</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.promopharma.it%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867384920%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=RaN6L8ii1FZC3MKlkGJ%2B5GViskE6I2ZMzO2CLJnVzoQ%3D&amp;reserved=0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.facebook.com%2FPromopharma%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867400601%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=mizukqoDbc0EWUojO0mJCp58gajL8PS9kCWamxs939Y%3D&amp;reserved=0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.instagram.com%2Fpromo.pharma%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867414451%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=cI2kO6HvuWbowQc9HLielWh72a2nT716ui5AGxo0vog%3D&amp;reserved=0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fpromopharma%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867427126%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=EBV9xS854VpULe2x3h3Hqt9l8pwFEjXifpNR9ZHPik4%3D&amp;reserved=0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.promopharma.it%2Fcdn%2Fshop%2Ffiles%2Fpromopharma_logo.png&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867344136%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=hh76V%2Fnj%2BoJm5dJRmaVdedJq%2BLjjECkOG93v90RzW24%3D&amp;reserved=0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.promopharma.it/&amp;data=05</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.promopharma.it%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867367412%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=Bvv7T7Loq8fherJobDzdyAm26jI0IdqyLhs7qdb%2FTBo%3D&amp;reserved=0</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.promopharma.it%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867384920%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=RaN6L8ii1FZC3MKlkGJ%2B5GViskE6I2ZMzO2CLJnVzoQ%3D&amp;reserved=0</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.facebook.com%2FPromopharma%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867400601%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=mizukqoDbc0EWUojO0mJCp58gajL8PS9kCWamxs939Y%3D&amp;reserved=0</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.instagram.com%2Fpromo.pharma%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867414451%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=cI2kO6HvuWbowQc9HLielWh72a2nT716ui5AGxo0vog%3D&amp;reserved=0</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fpromopharma%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867427126%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=EBV9xS854VpULe2x3h3Hqt9l8pwFEjXifpNR9ZHPik4%3D&amp;reserved=0</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.promopharma.it%2Fcdn%2Fshop%2Ffiles%2Fpromopharma_logo.png&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867344136%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=hh76V%2Fnj%2BoJm5dJRmaVdedJq%2BLjjECkOG93v90RzW24%3D&amp;reserved=0</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.facebook.com/Promopharma/&amp;data=05</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>https://www.instagram.com/promo.pharma/&amp;data=05</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/promopharma/&amp;data=05</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>https://www.promopharma.it/cdn/shop/files/promopharma_logo.png&amp;data=05</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.promopharma.it%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867367412%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=Bvv7T7Loq8fherJobDzdyAm26jI0IdqyLhs7qdb%2FTBo%3D&amp;reserved=0</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.promopharma.it%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867384920%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=RaN6L8ii1FZC3MKlkGJ%2B5GViskE6I2ZMzO2CLJnVzoQ%3D&amp;reserved=0</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.facebook.com%2FPromopharma%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867400601%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=mizukqoDbc0EWUojO0mJCp58gajL8PS9kCWamxs939Y%3D&amp;reserved=0</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.instagram.com%2Fpromo.pharma%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867414451%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=cI2kO6HvuWbowQc9HLielWh72a2nT716ui5AGxo0vog%3D&amp;reserved=0</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fpromopharma%2F&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867427126%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=EBV9xS854VpULe2x3h3Hqt9l8pwFEjXifpNR9ZHPik4%3D&amp;reserved=0</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.promopharma.it%2Fcdn%2Fshop%2Ffiles%2Fpromopharma_logo.png&amp;data=05%7C02%7C%7Cf16dfd71303a41ce54ea08df2080c579%7C0f6f68be4ef2465a986beb9a250d9789%7C0%7C0%7C639265409867344136%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=hh76V%2Fnj%2BoJm5dJRmaVdedJq%2BLjjECkOG93v90RzW24%3D&amp;reserved=0</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.promopharma.it/&amp;data=05</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>https://www.facebook.com/Promopharma/&amp;data=05</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>https://www.instagram.com/promo.pharma/&amp;data=05</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/promopharma/&amp;data=05</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>https://www.promopharma.it/cdn/shop/files/promopharma_logo.png&amp;data=05</url>
              <origin>EMAIL_BODY</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>eur01.safelinks.protection.outlook.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>eur01.safelinks.protection.outlook.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>eur01.safelinks.protection.outlook.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>eur01.safelinks.protection.outlook.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schema.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>info@promopharma.it</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>1848711D86E644D48C81668ACED19AE4-9EDB7F5F-12contabilitaclienti@promopharma.it</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>20496.1790944151.0@PHARMASAGE.promopharmaspa.local</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>20496.1790944151.1@PHARMASAGE.promopharmaspa.local</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>20496.1790944151.2@PHARMASAGE.promopharmaspa.local</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>8ea8ff70-e1c3-400a-9253-11b958ec2828@DU2PEPF00028D0E.eurprd03.prod.outlook.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>CONTABILITACLIENTI@PROMOPHARMA.IT</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>benedetto.lorini@volkswagen.it</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>benedetto.lorini@volkswagengroup.it</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>contabilitaclienti@promopharma.it</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>extern.matthias.colognese@volkswagengroup.it</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>mail.security@volkswagengroup.itmonica.facincani</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>monica.facincani@volkswagen.it</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>ontabilitaclienti@promopharma.it</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>10.167.242.22</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>80.21.103.222</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>52.102.113.20</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>4e55b90076b9a04040bc02270553906f9cf4538a56d327644302933a5103d761</SHA-256>
              <SHA-1>a7c3b4e65cf89977cb35cf20a989702e92864756</SHA-1>
              <MD5>180bac678eaa7cc362e65ec220e6ea72</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/pdf</file_type>
            </value>
            <value>
              <SHA-256>f0e6b80647274db96b877a4bd2b708fbc782677f21588e17336d99d953657b8a</SHA-256>
              <SHA-1>765415a96e8860a753cfdab10c2e81386b7fc7cd</SHA-1>
              <MD5>35c605427b1698043f58697a740420a1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>fe71a2991183b7cc1fca5c8584a23551dd9877181908feda8484af1313c9c86a</SHA-256>
              <SHA-1>0d66b8f594e1d7ca8acc620e677c5d6dec6312ea</SHA-1>
              <MD5>e7da1aab5a157d48d2b3b6d1aaa5313a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>a944126b3161d6fb61c757b3e1faed09b4a80baba2dc17d9cdc95259dc52844b</SHA-256>
              <SHA-1>046bc5ca0c9a0cd31ea1cb01c24b96d48137f029</SHA-1>
              <MD5>c428bfa351edaa3c8b0a33f3776501e8</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/x-ini</file_type>
            </value>
            <value>
              <SHA-256>7c41b898c5da0cfa4aa049b65ef50248bce9a72d24bef4c723786431921b75aa</SHA-256>
              <SHA-1>10588307553e766ab3c7d328d948dc6754893cef</SHA-1>
              <MD5>825644f747baab2c00e420dbbc39e4b3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>fa2dd01ed96d38758e89e354653c39f366bc7a34e485772c8aa2174b53a465d3</SHA-256>
              <SHA-1>e3ac032bfb32751b8f03c06fa70c51595003aa1b</SHA-1>
              <MD5>397e830923f3080ba63b3d38b53678ac</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>6524f56be979586ede5d8b958fc19c704b6b7406ca643e06b330df2aee3767a6</SHA-256>
              <SHA-1>47891af53a1b164a372f3cdca629f819d4bd1a6a</SHA-1>
              <MD5>76641c27cd310de0e530fdacea1750df</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>e1746c4970563e706cbdc33d886787028e1e96031125e57e9590daedcc40f225</SHA-256>
              <SHA-1>84770c6a5009b9dc455177f63ee0f6b57f47aedc</SHA-1>
              <MD5>ec239e0c24e67c6576bd75178fceb5ee</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>66483e6854f860373c36101a52b13b94a903b2cd2ad2dab880e7149bde51611a</SHA-256>
              <SHA-1>6e6bf9f1b5f63d417a38adc007cf585a5447ec45</SHA-1>
              <MD5>ac9f30d38d490dcf8a3d98a0ffde85bb</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>c65ac0f9e0aed8bc92d0115964efd5c812309ec749d36c38c9c56878a6dea392</SHA-256>
              <SHA-1>d934295af2d9774b52e7ce1e7393bd9e649b5c84</SHA-1>
              <MD5>2eafddf362b84a6d4a560daeeeb07334</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>4faf2605103952e654ca40983c134eccc127f6c51399316e2aebb2235beb2431</SHA-256>
              <SHA-1>ced396e4a4de8c894e47de49c2e85ea94fcb6642</SHA-1>
              <MD5>6b7dd1fed35e92af96e54aa8da4c3198</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>0f6f68be-4ef2-465a-986b-eb9a250d9789</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>15156475-e384-4638-86bc-546bdc0809d1</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>722372ca-32d2-4efb-8a80-f73f7f135fb5</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>76ac322c-b043-419c-a59b-82a039a35a8f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8ea8ff70-e1c3-400a-9253-11b958ec2828</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>bfeef8fd-30d6-4299-9cb7-276c7c784924</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>cd97ed20-5e14-48b0-b77d-08df2080c3af</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>f16dfd71-303a-41ce-54ea-08df2080c579</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>EXT Invio Fattura N.IT00126VSE00102.msg</name>
        <report_id>d76eb286-ac6f-4311-bc79-a257049413e2</report_id>
        <tags>
          <value>msg</value>
          <value>ole</value>
          <value>html</value>
          <value>png</value>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>4e55b90076b9a04040bc02270553906f9cf4538a56d327644302933a5103d761</id>
    <title>Analysis Report for 4e55b90076b9a04040bc02270553906f9cf4538a56d327644302933a5103d761</title>
    <updated>2026-10-05T11:58:04Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac390d3d130e7ad45267601</_id>
        <file_type>application/pdf</file_type>
        <flow_id>6ac390ca766af099f2b3a181</flow_id>
        <hash>4e55b90076b9a04040bc02270553906f9cf4538a56d327644302933a5103d761</hash>
        <iocs>
          <emails>
            <value>
              <email>info@promopharma.it</email>
              <origin>CONTENT_PARSE</origin>
            </value>
          </emails>
          <files>
            <value>
              <SHA-256>f0e6b80647274db96b877a4bd2b708fbc782677f21588e17336d99d953657b8a</SHA-256>
              <SHA-1>765415a96e8860a753cfdab10c2e81386b7fc7cd</SHA-1>
              <MD5>35c605427b1698043f58697a740420a1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>fe71a2991183b7cc1fca5c8584a23551dd9877181908feda8484af1313c9c86a</SHA-256>
              <SHA-1>0d66b8f594e1d7ca8acc620e677c5d6dec6312ea</SHA-1>
              <MD5>e7da1aab5a157d48d2b3b6d1aaa5313a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
          </files>
        </iocs>
        <name>jobrpt_Y-PP-FTV_PROMO_92632.pdf</name>
        <report_id>a6a42ab6-ed38-4d6f-a634-3d72749aaaeb</report_id>
        <tags>
          <value>pdf</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e000b6ed57da48da099dff02a9fbef8eea9fd0c4ed0abdf6f7dc2ce2826cf9ae</id>
    <title>Analysis Report for e000b6ed57da48da099dff02a9fbef8eea9fd0c4ed0abdf6f7dc2ce2826cf9ae</title>
    <updated>2026-10-05T11:56:58Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39091d130e7ad452675f5</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac39088766af099f2b3a05c</flow_id>
        <hash>e000b6ed57da48da099dff02a9fbef8eea9fd0c4ed0abdf6f7dc2ce2826cf9ae</hash>
        <iocs/>
        <name>9969009_928ce1e9-0599-4f35-823b-7052467b8e69@9969009</name>
        <report_id>b923d6e0-ed92-45ef-9561-c2cc1cecac9e</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T11:56:31Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3907b89017dd18dc1c022</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac3906c7e4998b7d617fb43</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>76b67467-1935-4e13-a3a1-49ffb050c0ed</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T11:56:25Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac39077d130e7ad452675f0</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac39067766af099f2b39fdd</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>dd28de17-5b27-424b-ac3a-c307123d16ba</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>c4db5f522f9d958d949f10248777875d04c243bbc07b2738a4b3725a5db63c83</id>
    <title>Analysis Report for c4db5f522f9d958d949f10248777875d04c243bbc07b2738a4b3725a5db63c83</title>
    <updated>2026-10-05T11:53:51Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38ff6d130e7ad452675d8</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac38fce7e4998b7d617f9c2</flow_id>
        <hash>c4db5f522f9d958d949f10248777875d04c243bbc07b2738a4b3725a5db63c83</hash>
        <iocs>
          <urls>
            <value>
              <url>https://artikel.guenstig-heizen.de</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://9onwvnfi1l.kameleoon.io/engine.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ad.doubleclick.net/ccm/s/collect?_gsid=qrq0FzL1B2pPRA38MzQEgQNAE6qCPx9AtA&amp;auid=1735142703.1791201242&amp;gtm=45E92e69u2v76836414za204zd76836414xeaxf4&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ams.creativecdn.com/tags/v2?type=json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ams.creativecdn.com/tags/v2?type=json&amp;tc=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ams46.creativecdn.com/info?tk=eebsAFGjMAmb-G6fcn5GIUuz52fhkK1JmQY8BJJa5gtAuOBBXR0IKiZQWtY6DsZiahsQcJU_nn4ixVVgbpSw9wA</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://artikel.guenstig-heizen.de#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/67eeafb2f84585930e46cd9b_Lato-Black.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/67eeafb2f84585930e46cd9c_Lato-ThinItalic.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/67eeafb2f84585930e46cd9d_Lato-Thin.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/67eeafb2f84585930e46cd9e_Lato-BlackItalic.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/67eeafb2f84585930e46cd9f_Lato-LightItalic.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/67eeafb2f84585930e46cda0_Lato-Bold.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/67eeafb2f84585930e46cda8_Lato-Regular.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/67eeafb2f84585930e46cdaa_Lato-Italic.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/67eeafb2f84585930e46cdab_Lato-BoldItalic.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/67eeafb2f84585930e46cdad_Lato-Light.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/67f3a1c2f436989f179e6911_Waermepumpe-full-garten.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/67f78eddd7d3edba6a39634c_GH_Favicon_32x32_v2.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/67f8dc98f1fda4fe16835496_guenstig-heizen-logo.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/6853cfb7e4262608d318bc38_6690d23e23577f4f3e5975ab_poppins-v21-latin-regular.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/688b0bc2aa19a32d4ea92056_Poppins-SemiBold.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/css/guenstig-heizen.shared.088cc8c10.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/js/guenstig-heizen.b0057e7c.7b091178c1468cf8.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/js/guenstig-heizen.schunk.222b55bb9f420466.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/js/guenstig-heizen.schunk.36b8fb49256177c8.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46ccae/67f4dbdaf39e489c990dfb38_enpal-waermepumpe-p-500.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46ccae/67f4dbf66620d9b7013b07f2_Waermepumpe-full-garten-quer-p-500.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46ccae/67f4dd4b6620d9b7013c3970_monteur-waermepumpe-installation-p-500.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46ccae/67f4dd8dc585304e6b31d720_waermepumpe-installateur-p-500.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46ccae/67f4dda210f219c7de1b86f1_montage-waermeumpe-p-500.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46ccae/67f4ddbf6a9501f92ee619b0_enpal-waermepumpe-frontal-p-500.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/682dd4da061deb3908447f69/6915e40dd8400809a2686c1b_Slider_Icons_oel.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/682dd4da061deb3908447f69/6915e40dfc79fcd87aa5b091_Slider_Icons_Gas.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cm.creativecdn.com/adx/cm?v=2&amp;pi=adx&amp;tdc=ams&amp;google_gid=CAESED9sM5pSnanCw-ZOQNHWU54&amp;google_cver=1&amp;google_ula=5153224,0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=67eeafb2f84585930e46cc81</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d5yoctgpv4cpx.cloudfront.net/RUM-3D6B58D121/v4-www.guenstig-heizen.de.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d5yoctgpv4cpx.cloudfront.net/RUM-91E5B61F40/v4-www.guenstig-heizen.de.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d5yoctgpv4cpx.cloudfront.net/RUM-B1C739B031/v4-www.guenstig-heizen.de.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d5yoctgpv4cpx.cloudfront.net/RUM-C1702051FA/v4-www.guenstig-heizen.de.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d5yoctgpv4cpx.cloudfront.net/RUM-CC0A8744DC/v4-www.guenstig-heizen.de.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://eu-data.kameleoon.io/active-script/event?engine=true&amp;siteCode=9onwvnfi1l</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://eu-data.kameleoon.io/geolocation?engine=true</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://eu-data.kameleoon.io/visit/events?engine=true&amp;siteCode=9onwvnfi1l&amp;visitorCode=7ekl8bog630uofrd&amp;itp=false&amp;tabId=A11E6E7B</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Lato:100,100italic,300,300italic,400,400italic,700,700italic,900,900italic%7COpen+Sans:300,300italic,400,400italic,600,600italic,700,700italic,800,800italic</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/lato/v25/S6u-w4BMUTPHjxsIPx-oPCI.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/lato/v25/S6u8w4BMUTPHh30AXC-q.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/lato/v25/S6u8w4BMUTPHjxsAXC-q.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/lato/v25/S6u9w4BMUTPHh50XSwiPGQ.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/lato/v25/S6u9w4BMUTPHh6UVSwiPGQ.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/lato/v25/S6u9w4BMUTPHh7USSwiPGQ.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/lato/v25/S6u_w4BMUTPHjxsI3wi_Gwft.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/lato/v25/S6u_w4BMUTPHjxsI5wq_Gwft.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/lato/v25/S6u_w4BMUTPHjxsI9w2_Gwft.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/lato/v25/S6uyw4BMUTPHjx4wXg.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/opensans/v44/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://googleads.g.doubleclick.net/pagead/viewthroughconversion/17304999453/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://googleads.g.doubleclick.net/pagead/viewthroughconversion/17304999453/?random=1791201242062&amp;cv=11&amp;fst=1791201242062&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v899609892z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3tPt2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616985~115938466~115938468~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=0&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=9&amp;rfmt=3&amp;fmt=4</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://googleads.g.doubleclick.net/pagead/viewthroughconversion/17666914363/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://googleads.g.doubleclick.net/pagead/viewthroughconversion/17666914363/?random=1791201242457&amp;cv=11&amp;fst=1791201242457&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v9231226798z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938469~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=16&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=9&amp;rfmt=3&amp;fmt=4</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://googleads.g.doubleclick.net/pagead/viewthroughconversion/17843011491/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://googleads.g.doubleclick.net/pagead/viewthroughconversion/17843011491/?random=1791201241921&amp;cv=11&amp;fst=1791201241921&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v9239457488z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938468~117776795~118131809~118897920~118897930~120213116~120385423~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=6&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=9&amp;rfmt=3&amp;fmt=4</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://googleads.g.doubleclick.net/pagead/viewthroughconversion/18201978533/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://googleads.g.doubleclick.net/pagead/viewthroughconversion/18201978533/?random=1791201242141&amp;cv=11&amp;fst=1791201242141&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v9254130425z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616986~115938466~115938469~117776795~118131809~118897920~118897930~120213116~120385423~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=12&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=9&amp;rfmt=3&amp;fmt=4</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://googleads.g.doubleclick.net/pagead/viewthroughconversion/857207419/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://googleads.g.doubleclick.net/pagead/viewthroughconversion/857207419/?random=1791201242032&amp;cv=11&amp;fst=1791201242032&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v899609892z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3tPt2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616985~115938466~115938468~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=0&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=9&amp;rfmt=3&amp;fmt=4</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D315%26code%3Dy364eYdT-BFetWCNhH6Hukw4kreg1bKV2l4bhlBE3NY%26consent%3D1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://intl-slider.cust.enpal.io/index.html?t=1791201241563</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://intl-slider.cust.enpal.io/scripts/enpal-components.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://intl-slider.cust.enpal.io/static/css/main.f0641997.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://intl-slider.cust.enpal.io/static/js/main.b7e958e8.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://p2iqhncxyh.execute-api.eu-central-1.amazonaws.com/Production/v2/beacon</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.analytics.google.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.analytics.google.com/g/collect?v=2&amp;tid=G-TZYHNJ4L4R&amp;gtm=45g92e69u2v881533203z876836414za20kzb76836414zd76836414xf4&amp;_p=1791201241400&amp;_gaz=1&amp;gcs=G111&amp;gcd=13t3tPt2t5l1&amp;npa=0&amp;dma_cps=a&amp;dma=1&amp;gdid=dZGVlNj.dYWYxNW&amp;_eu=AAAAAGAC&amp;_uip=%3A%3A&amp;are=1&amp;cid=340549791.1791201242&amp;frm=0&amp;pscdl=noapi&amp;rcb=10&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;ur=DE-HE&amp;gaf=2&amp;_s=1&amp;tag_exp=115616985~115938466~115938468~118897920~118897930~120213116~120385423~120469145~120469153~121246026~121246034&amp;sid=1791201242&amp;sct=1&amp;seg=0&amp;dl=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;dt=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;gtb=1&amp;_tu=CA&amp;en=page_view&amp;_fv=1&amp;_nsi=1&amp;_ss=1&amp;gap.gtb=1&amp;tfd=1292</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect?v=2&amp;tid=G-27FCFPR55H&amp;gtm=45892e69u2v9231226798z876836414za20kzb76836414zd76836414xf4&amp;_p=1791201241400&amp;gcs=G111&amp;gcd=13t3t3t2t5l1&amp;npa=0&amp;dma_cps=a&amp;dma=1&amp;gdid=dZGVlNj.dYWYxNW&amp;_uip=%3A%3A&amp;are=1&amp;cid=340549791.1791201242&amp;frm=0&amp;ngs=1&amp;pscdl=noapi&amp;rcb=16&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;ur=DE-HE&amp;_s=1&amp;tag_exp=115938466~115938469~118897920~118897930~120213116~120385422~120469145~120469153&amp;sid=1791201242&amp;sct=1&amp;seg=0&amp;dl=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;dt=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;gtb=1&amp;_tu=CA&amp;en=page_view&amp;_fv=1&amp;_ss=1&amp;gap.gtb=1&amp;tfd=1470</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://slider-assets.cust.enpal.io/slider-images/Marketing-Materials/slider_background.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://solar-slider.cust.enpal.io/scripts/enpal-cookies-v3.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://stats.g.doubleclick.net/g/collect?v=2&amp;tid=G-TZYHNJ4L4R&amp;cid=340549791.1791201242&amp;gtm=45g92e69u2v881533203z876836414za20kzb76836414zd76836414xf4&amp;rcb=10&amp;aip=1&amp;dma=1&amp;dma_cps=a&amp;gcs=G111&amp;gcd=13t3tPt2t5l1&amp;npa=0&amp;frm=0&amp;tag_exp=115616985~115938466~115938468~118897920~118897930~120213116~120385423~120469145~120469153~121246026~121246034</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://stats.g.doubleclick.net/j/collect?t=dc&amp;aip=1&amp;_r=3&amp;v=1&amp;_v=j102&amp;tid=UA-97991066-1&amp;cid=340549791.1791201242&amp;jid=227982726&amp;gjid=1114981764&amp;_gid=1465428222.1791201243&amp;_u=YCDAgEABAAAAAGAAI~&amp;z=220158033</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tags.creativecdn.com/P0HxKNpp4Qe3nd0JOCO9.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://trck.spoteffects.net/analytics/spef.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://uploads-ssl.webflow.com/5e870ec047674e044920655e/64382c7928d32f63f92ee7a7_Slider_Icons_strom.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://uploads-ssl.webflow.com/5e870ec047674e044920655e/645b5fac3713b78a400f5b01_Slider_Icons_Anderes.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://westeurope-5.in.applicationinsights.azure.com//v2/track</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.enpal.de/?</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google-analytics.com/analytics.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect?v=1&amp;_v=j102&amp;aip=1&amp;a=572770588&amp;t=pageview&amp;_s=1&amp;dl=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;ul=en-us&amp;dt=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;sr=800x600&amp;vp=1905x1080&amp;_u=YCDAgEABAAAAACAAI~&amp;jid=227982726&amp;gjid=1114981764&amp;cid=340549791.1791201242&amp;tid=UA-97991066-1&amp;_gid=1465428222.1791201243&amp;_slc=1&amp;gtm=45E92e69u2n81MV7CD8Dv76836414za204zd76836414xf4&amp;cd1=www.guenstig-heizen.de%2F&amp;gcs=G111&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938469~117776795~117971173~118131809~118897920~118897930~120385423~120469145~120469153~121246026~121246034~121436580&amp;z=230675564</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect?rcb=0&amp;frm=0&amp;apvc=0&amp;auid=1735142703.1791201242&amp;dt=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;tid=AW-857207419&amp;en=page_view&amp;dl=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;scrsrc=www.guenstig-heizen.de&amp;rnd=1819997049.1791201242&amp;navt=n&amp;npa=0&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;_tu=CA&amp;gtb=1&amp;gtm=45892e69u2v899609892z876836414za20kzb76836414zd76836414xecxf4&amp;gcs=G111&amp;gcd=13t3tPt2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616985~115938466~115938468~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153&amp;tft=1791201242076&amp;tfd=1095&amp;_gsid=qrq0FzL1B2pPRA38MzQEgQNAE6qCPx9AtA&amp;gap.gtb=1&amp;tids=AW-857207419~AW-17304999453&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect?rcb=12&amp;frm=0&amp;apvc=0&amp;auid=1735142703.1791201242&amp;dt=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;tid=AW-18201978533&amp;en=page_view&amp;dl=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;scrsrc=www.guenstig-heizen.de&amp;rnd=1819997049.1791201242&amp;navt=n&amp;npa=0&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;_tu=CA&amp;gtb=1&amp;gtm=45892e69u2v9254130425z876836414za20kzb76836414zd76836414xecxf4&amp;gcs=G111&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616986~115938466~115938469~117776795~118131809~118897920~118897930~120213116~120385423~120469145~120469153&amp;tft=1791201242177&amp;tfd=1196&amp;_gsid=qrq0FzL1B2pPRA38MzQEgQNAE6qCPx9AtA&amp;gap.gtb=1&amp;tids=AW-18201978533&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect?rcb=13&amp;frm=0&amp;apvc=0&amp;auid=1735142703.1791201242&amp;dt=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;tid=DC-14978958&amp;en=page_view&amp;dl=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;scrsrc=www.guenstig-heizen.de&amp;rnd=1819997049.1791201242&amp;navt=n&amp;npa=0&amp;gdid=dZGVlNj.dYWYxNW&amp;_tu=CA&amp;gtb=1&amp;gtm=45c92e69u2v9199029329z876836414za20kzb76836414zd76836414xecxf4&amp;gcs=G111&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938469~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153~121246027~121246035&amp;tft=1791201242352&amp;tfd=1371&amp;_gsid=qrq0FzL1B2pPRA38MzQEgQNAE6qCPx9AtA&amp;gap.gtb=1&amp;tids=DC-14978958&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect?rcb=16&amp;frm=0&amp;apvc=0&amp;auid=1735142703.1791201242&amp;dt=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;tid=AW-17666914363&amp;en=page_view&amp;dl=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;scrsrc=www.guenstig-heizen.de&amp;rnd=1819997049.1791201242&amp;navt=n&amp;npa=0&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;_tu=CA&amp;gtb=1&amp;gtm=45892e69u2v9231226798z876836414za20kzb76836414zd76836414xecxf4&amp;gcs=G111&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938469~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153&amp;tft=1791201242498&amp;tfd=1517&amp;_gsid=qrq0FzL1B2pPRA38MzQEgQNAE6qCPx9AtA&amp;gap.gtb=1&amp;tids=AW-17666914363&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect?rcb=6&amp;frm=0&amp;apvc=0&amp;auid=1735142703.1791201242&amp;dt=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;tid=AW-17843011491&amp;en=page_view&amp;dl=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;scrsrc=www.guenstig-heizen.de&amp;rnd=1819997049.1791201242&amp;navt=n&amp;npa=0&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;_tu=CA&amp;gtb=1&amp;gtm=45892e69u2v9239457488z876836414za20kzb76836414zd76836414xecxf4&amp;gcs=G111&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938468~117776795~118131809~118897920~118897930~120213116~120385423~120469145~120469153&amp;tft=1791201241963&amp;tfd=982&amp;_gsid=qrq0FzL1B2pPRA38MzQEgQNAE6qCPx9AtA&amp;gap.gtb=1&amp;tids=AW-17843011491&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect?rcb=8&amp;frm=0&amp;apvc=1&amp;ae=g&amp;auid=1735142703.1791201242&amp;dt=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;en=page_view&amp;dl=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;scrsrc=www.guenstig-heizen.de&amp;rnd=1819997049.1791201242&amp;navt=n&amp;npa=0&amp;ep.ads_data_redaction=0&amp;gdid=dZGVlNj.dYWYxNW.dNzQzZD&amp;_tu=CA&amp;gtb=1&amp;gtm=45E92e69u2v76836414za204zd76836414xeaxf4&amp;gcs=G111&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938469~117776795~118131809~118897920~118897930~120385423~120469145~120469153~121246026~121246034~121436580&amp;tft=1791201241775&amp;tfd=795&amp;_gsid=qrq0FzL1B2pPRA38MzQEgQNAE6qCPx9AtA&amp;gap.gtb=1&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/pagead/1p-user-list/17304999453/</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/pagead/1p-user-list/17304999453/?random=1791201242062&amp;cv=11&amp;fst=1791198000000&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v899609892z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3tPt2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616985~115938466~115938468~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=0&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=9&amp;rfmt=3&amp;fmt=3&amp;is_vtc=1&amp;cid=CAQSXgBAziHc0sF6IG3rf885_iswXvPPebY9YzXlcUYRd6FbQVvQ9pVHNTrPQ07rws7paDq3yZow8TlLuOfCLdt0nT9Vq-TgszBN1C-Rq9vXmJuypZtf3vaU2IupFsQhTdM&amp;random=1186803396&amp;rmt_tld=0&amp;ipr=y</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/pagead/1p-user-list/17666914363/</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/pagead/1p-user-list/17666914363/?random=1791201242457&amp;cv=11&amp;fst=1791198000000&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v9231226798z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938469~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=16&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=9&amp;rfmt=3&amp;fmt=3&amp;is_vtc=1&amp;cid=CAQSXgBAziHc0oIo2nllHOmAChURW7GnKfvHGP_Z78ZT_jjfwU3Yev7PutEdq6R8j6pe5M_cj6igrrPEB0Ycc5Bbppz5xoNAXPDs3T8SSRZ7AJMX6xPGRFrV_v4LttESP00&amp;random=4061752585&amp;rmt_tld=0&amp;ipr=y</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/pagead/1p-user-list/17843011491/</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/pagead/1p-user-list/17843011491/?random=1791201241921&amp;cv=11&amp;fst=1791198000000&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v9239457488z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938468~117776795~118131809~118897920~118897930~120213116~120385423~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=6&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=9&amp;rfmt=3&amp;fmt=3&amp;is_vtc=1&amp;cid=CAQSUABAziHcWyhjNB1YIar6u77x38l7QcaC8QZ1QF1MHpgFuvZhgO93aeCHRCP2zr6DqflIfYKg4OwvDUTtne_mF2zvC2UECZMkfHRYAXjZXmk5&amp;random=3170436394&amp;rmt_tld=0&amp;ipr=y</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/pagead/1p-user-list/18201978533/</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/pagead/1p-user-list/18201978533/?random=1791201242141&amp;cv=11&amp;fst=1791198000000&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v9254130425z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616986~115938466~115938469~117776795~118131809~118897920~118897930~120213116~120385423~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=12&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=9&amp;rfmt=3&amp;fmt=3&amp;is_vtc=1&amp;cid=CAQSXgBAziHc0sSOkxRyRqc_hH7fMtWJ_2BUe9u5gisCNAkTPHJ5GYsOVizn6K1Lnj1-y0418i2xKocddBgVZ7Cv_qy4Zcvy5mXG36d-XCBISxajTA6TuXkIuZKYe8xcnGI&amp;random=2599549914&amp;rmt_tld=0&amp;ipr=y</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/pagead/1p-user-list/857207419/</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/pagead/1p-user-list/857207419/?random=1791201242032&amp;cv=11&amp;fst=1791198000000&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v899609892z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3tPt2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616985~115938466~115938468~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=0&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=9&amp;rfmt=3&amp;fmt=3&amp;is_vtc=1&amp;cid=CAQSXgBAziHcpX80I7C1yRiAajw8wgnQVsbHxvSd2kAiWQBPqbjOAKll8IKXR7ZKVAQHrgXvpqHjvglo4ZIcY71dFn3dvZbyK9PrafrP1iheYW2DtBmORB8CXEj64u3IdZI&amp;random=607464570&amp;rmt_tld=0&amp;ipr=y</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/rmkt/collect/17304999453/</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/rmkt/collect/17304999453/?random=1791201242062&amp;cv=11&amp;fst=1791201242062&amp;fmt=8&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v899609892z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3tPt2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616985~115938466~115938468~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=0&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=68&amp;gcp=5</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/rmkt/collect/17666914363/</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/rmkt/collect/17666914363/?random=1791201242457&amp;cv=11&amp;fst=1791201242457&amp;fmt=8&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v9231226798z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938469~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=16&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=68&amp;gcp=5</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/rmkt/collect/17843011491/</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/rmkt/collect/17843011491/?random=1791201241921&amp;cv=11&amp;fst=1791201241921&amp;fmt=8&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v9239457488z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938468~117776795~118131809~118897920~118897930~120213116~120385423~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=6&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=68&amp;gcp=5</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/rmkt/collect/18201978533/</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/rmkt/collect/18201978533/?random=1791201242141&amp;cv=11&amp;fst=1791201242141&amp;fmt=8&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v9254130425z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616986~115938466~115938469~117776795~118131809~118897920~118897930~120213116~120385423~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=12&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=68&amp;gcp=5</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/rmkt/collect/857207419/</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/rmkt/collect/857207419/?random=1791201242032&amp;cv=11&amp;fst=1791201242032&amp;fmt=8&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v899609892z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3tPt2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616985~115938466~115938468~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=0&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=68&amp;gcp=5</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.de/ads/ga-audiences?v=1&amp;t=sr&amp;slf_rd=1&amp;_r=4&amp;tid=G-TZYHNJ4L4R&amp;cid=340549791.1791201242&amp;gtm=45g92e69u2v881533203z876836414za20kzb76836414zd76836414xf4&amp;rcb=10&amp;aip=1&amp;dma=1&amp;dma_cps=a&amp;gcs=G111&amp;gcd=13t3tPt2t5l1&amp;npa=0&amp;frm=0&amp;tag_exp=115616985~115938466~115938468~118897920~118897930~120213116~120385423~120469145~120469153~121246026~121246034&amp;z=1947582918</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.de/pagead/1p-user-list/17304999453/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.de/pagead/1p-user-list/17304999453/?random=1791201242062&amp;cv=11&amp;fst=1791198000000&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v899609892z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3tPt2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616985~115938466~115938468~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=0&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=9&amp;rfmt=3&amp;fmt=3&amp;is_vtc=1&amp;cid=CAQSXgBAziHc0sF6IG3rf885_iswXvPPebY9YzXlcUYRd6FbQVvQ9pVHNTrPQ07rws7paDq3yZow8TlLuOfCLdt0nT9Vq-TgszBN1C-Rq9vXmJuypZtf3vaU2IupFsQhTdM&amp;random=1186803396&amp;rmt_tld=1&amp;ipr=y</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.de/pagead/1p-user-list/17666914363/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.de/pagead/1p-user-list/17666914363/?random=1791201242457&amp;cv=11&amp;fst=1791198000000&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v9231226798z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938469~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=16&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=9&amp;rfmt=3&amp;fmt=3&amp;is_vtc=1&amp;cid=CAQSXgBAziHc0oIo2nllHOmAChURW7GnKfvHGP_Z78ZT_jjfwU3Yev7PutEdq6R8j6pe5M_cj6igrrPEB0Ycc5Bbppz5xoNAXPDs3T8SSRZ7AJMX6xPGRFrV_v4LttESP00&amp;random=4061752585&amp;rmt_tld=1&amp;ipr=y</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.de/pagead/1p-user-list/17843011491/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.de/pagead/1p-user-list/17843011491/?random=1791201241921&amp;cv=11&amp;fst=1791198000000&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v9239457488z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938468~117776795~118131809~118897920~118897930~120213116~120385423~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=6&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=9&amp;rfmt=3&amp;fmt=3&amp;is_vtc=1&amp;cid=CAQSUABAziHcWyhjNB1YIar6u77x38l7QcaC8QZ1QF1MHpgFuvZhgO93aeCHRCP2zr6DqflIfYKg4OwvDUTtne_mF2zvC2UECZMkfHRYAXjZXmk5&amp;random=3170436394&amp;rmt_tld=1&amp;ipr=y</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.de/pagead/1p-user-list/18201978533/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.de/pagead/1p-user-list/18201978533/?random=1791201242141&amp;cv=11&amp;fst=1791198000000&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v9254130425z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616986~115938466~115938469~117776795~118131809~118897920~118897930~120213116~120385423~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=12&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=9&amp;rfmt=3&amp;fmt=3&amp;is_vtc=1&amp;cid=CAQSXgBAziHc0sSOkxRyRqc_hH7fMtWJ_2BUe9u5gisCNAkTPHJ5GYsOVizn6K1Lnj1-y0418i2xKocddBgVZ7Cv_qy4Zcvy5mXG36d-XCBISxajTA6TuXkIuZKYe8xcnGI&amp;random=2599549914&amp;rmt_tld=1&amp;ipr=y</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.de/pagead/1p-user-list/857207419/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.de/pagead/1p-user-list/857207419/?random=1791201242032&amp;cv=11&amp;fst=1791198000000&amp;bg=ffffff&amp;guid=ON&amp;async=1&amp;en=gtag.config&amp;gtm=45892e69u2v899609892z876836414za20kzb76836414zd76836414xecxf4&amp;gcd=13t3tPt2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616985~115938466~115938468~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153&amp;u_w=800&amp;u_h=600&amp;url=https%3A%2F%2Fwww.guenstig-heizen.de%2F&amp;rcb=0&amp;frm=0&amp;tiba=G%C3%BCnstig-Heizen.de%20-%20powered%20by%20Enpal&amp;did=dZGVlNj%2CdYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;hn=www.googleadservices.com&amp;npa=0&amp;pscdl=noapi&amp;auid=1735142703.1791201242&amp;uaa=&amp;uab=&amp;uafvl=&amp;uamb=0&amp;uam=&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;_tu=CA&amp;gtb=1&amp;data=event%3Dgtag.config&amp;gap.gtb=1&amp;ept=9&amp;rfmt=3&amp;fmt=3&amp;is_vtc=1&amp;cid=CAQSXgBAziHcpX80I7C1yRiAajw8wgnQVsbHxvSd2kAiWQBPqbjOAKll8IKXR7ZKVAQHrgXvpqHjvglo4ZIcY71dFn3dvZbyK9PrafrP1iheYW2DtBmORB8CXEj64u3IdZI&amp;random=607464570&amp;rmt_tld=1&amp;ipr=y</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=GTM-MV7CD8D&amp;gtg_health=1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/heizung-umruesten</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/luftwaermepumpe</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/stromtarif-waermepumpe</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/stromverbrauch-waermepumpe</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/waermepumpe</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/waermepumpe-altbau</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/waermepumpe-foerderung</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/waermepumpe-funktion</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/waermepumpe-kosten</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/waermepumpe-mit-photovoltaik</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/wvxwa3jtwetcNjdlZWFmYjJmODQ1ODU5MzBlNDZjYzgx/jaCxxprdyZSnFLCLt3PxXb-8fuSpJ3qtAMQfQkybQX-P1HdG</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/wvxwa3jtwetcNjdlZWFmYjJmODQ1ODU5MzBlNDZjYzgx/jaCxxprdyZSnHb2OtXL_Xrawa7T3eWG2BJYVCxXDQyPM3_udd0Y</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/wvxwa3jtwetcNjdlZWFmYjJmODQ1ODU5MzBlNDZjYzgx/jaCxxprdyZSnHbKEsXD2WL-xYbb3eWG2BJYVCxXDQyPM3_udd0Y</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/wvxwa3jtwetcNjdlZWFmYjJmODQ1ODU5MzBlNDZjYzgx/jaCxxprdyZSnHbOLsHH3WrmxarL3eWG2BJYVCxXDQyPM3_udd0Y</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/wvxwa3jtwetcNjdlZWFmYjJmODQ1ODU5MzBlNDZjYzgx/jaCxxprdz-7edtz0ywnyJbrXfuSpJ3qtAMQfQkybQX-P1HdG</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/wvxwa3jtwetcNjdlZWFmYjJmODQ1ODU5MzBlNDZjYzgx/jaCxxprdz5fHAcjqsgCCUcp3Rg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/wvxwa3jtwetcNjdlZWFmYjJmODQ1ODU5MzBlNDZjYzgx/jaCxxprdzICnHbGFsnv_XLajO__seT_sE91PSx3ITjPId0Y</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:guenstig-heizen@enpal.de?</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>Günstig-Heizen.de</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/&amp;dt=</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/&amp;rcb=0&amp;frm=0&amp;tiba=</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/&amp;rcb=12&amp;frm=0&amp;tiba=</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/&amp;rcb=16&amp;frm=0&amp;tiba=</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/&amp;rcb=6&amp;frm=0&amp;tiba=</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/&amp;scrsrc=www.guenstig-heizen.de&amp;rnd=1819997049.1791201242&amp;navt=n&amp;npa=0&amp;did=dZGVlNj,dYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;_tu=CA&amp;gtb=1&amp;gtm=45892e69u2v899609892z876836414za20kzb76836414zd76836414xecxf4&amp;gcs=G111&amp;gcd=13t3tPt2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616985~115938466~115938468~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153&amp;tft=1791201242076&amp;tfd=1095&amp;_gsid=qrq0FzL1B2pPRA38MzQEgQNAE6qCPx9AtA&amp;gap.gtb=1&amp;tids=AW-857207419~AW-17304999453&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/&amp;scrsrc=www.guenstig-heizen.de&amp;rnd=1819997049.1791201242&amp;navt=n&amp;npa=0&amp;did=dZGVlNj,dYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;_tu=CA&amp;gtb=1&amp;gtm=45892e69u2v9231226798z876836414za20kzb76836414zd76836414xecxf4&amp;gcs=G111&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938469~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153&amp;tft=1791201242498&amp;tfd=1517&amp;_gsid=qrq0FzL1B2pPRA38MzQEgQNAE6qCPx9AtA&amp;gap.gtb=1&amp;tids=AW-17666914363&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/&amp;scrsrc=www.guenstig-heizen.de&amp;rnd=1819997049.1791201242&amp;navt=n&amp;npa=0&amp;did=dZGVlNj,dYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;_tu=CA&amp;gtb=1&amp;gtm=45892e69u2v9239457488z876836414za20kzb76836414zd76836414xecxf4&amp;gcs=G111&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938468~117776795~118131809~118897920~118897930~120213116~120385423~120469145~120469153&amp;tft=1791201241963&amp;tfd=982&amp;_gsid=qrq0FzL1B2pPRA38MzQEgQNAE6qCPx9AtA&amp;gap.gtb=1&amp;tids=AW-17843011491&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/&amp;scrsrc=www.guenstig-heizen.de&amp;rnd=1819997049.1791201242&amp;navt=n&amp;npa=0&amp;did=dZGVlNj,dYWYxNW&amp;gdid=dZGVlNj.dYWYxNW&amp;_tu=CA&amp;gtb=1&amp;gtm=45892e69u2v9254130425z876836414za20kzb76836414zd76836414xecxf4&amp;gcs=G111&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616986~115938466~115938469~117776795~118131809~118897920~118897930~120213116~120385423~120469145~120469153&amp;tft=1791201242177&amp;tfd=1196&amp;_gsid=qrq0FzL1B2pPRA38MzQEgQNAE6qCPx9AtA&amp;gap.gtb=1&amp;tids=AW-18201978533&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/&amp;scrsrc=www.guenstig-heizen.de&amp;rnd=1819997049.1791201242&amp;navt=n&amp;npa=0&amp;ep.ads_data_redaction=0&amp;gdid=dZGVlNj.dYWYxNW.dNzQzZD&amp;_tu=CA&amp;gtb=1&amp;gtm=45E92e69u2v76836414za204zd76836414xeaxf4&amp;gcs=G111&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938469~117776795~118131809~118897920~118897930~120385423~120469145~120469153~121246026~121246034~121436580&amp;tft=1791201241775&amp;tfd=795&amp;_gsid=qrq0FzL1B2pPRA38MzQEgQNAE6qCPx9AtA&amp;gap.gtb=1&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/&amp;scrsrc=www.guenstig-heizen.de&amp;rnd=1819997049.1791201242&amp;navt=n&amp;npa=0&amp;gdid=dZGVlNj.dYWYxNW&amp;_tu=CA&amp;gtb=1&amp;gtm=45c92e69u2v9199029329z876836414za20kzb76836414zd76836414xecxf4&amp;gcs=G111&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938469~117776795~118131809~118897920~118897930~120213116~120385422~120469145~120469153~121246027~121246035&amp;tft=1791201242352&amp;tfd=1371&amp;_gsid=qrq0FzL1B2pPRA38MzQEgQNAE6qCPx9AtA&amp;gap.gtb=1&amp;tids=DC-14978958&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/&amp;ul=en-us&amp;dt=</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>www.googleadservices.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>www.guenstig-heizen.de/&amp;gcs=G111&amp;gcd=13t3t3t2t5l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938469~117776795~117971173~118131809~118897920~118897930~120385423~120469145~120469153~121246026~121246034~121436580&amp;z=230675564</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/67f78eddd7d3edba6a39634c_GH_Favicon_32x32_v2.svg</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/67f78ef1791e915bed6b4c51_GH_Favicon_256x256_v2.svg</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/css/guenstig-heizen.shared.088cc8c10.css</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/js/guenstig-heizen.b0057e7c.7b091178c1468cf8.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/js/guenstig-heizen.schunk.222b55bb9f420466.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/67eeafb2f84585930e46cc81/js/guenstig-heizen.schunk.36b8fb49256177c8.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=67eeafb2f84585930e46cc81</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://intl-slider.cust.enpal.io/scripts/enpal-components.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://solar-slider.cust.enpal.io/scripts/enpal-cookies-v3.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.enpal.de</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/heizung-umruesten</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/luftwaermepumpe</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/stromtarif-waermepumpe</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/stromverbrauch-waermepumpe</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/waermepumpe</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/waermepumpe-altbau</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/waermepumpe-foerderung</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/waermepumpe-funktion</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/waermepumpe-kosten</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.guenstig-heizen.de/blog/waermepumpe-mit-photovoltaik</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>ajax.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>cdn.prod.website-files.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>d3e54v103j8qbb.cloudfront.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>intl-slider.cust.enpal.io</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>solar-slider.cust.enpal.io</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.enpal.de</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.guenstig-heizen.de</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>9onwvnfi1l.kameleoon.io</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ad.doubleclick.net</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>ajax.googleapis.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ams.creativecdn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ams46.creativecdn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>artikel.guenstig-heizen.de</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cdn.prod.website-files.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cm.creativecdn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>d3e54v103j8qbb.cloudfront.net</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>d5yoctgpv4cpx.cloudfront.net</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>eu-data.kameleoon.io</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>googleads.g.doubleclick.net</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>ib.adnxs.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>intl-slider.cust.enpal.io</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>p2iqhncxyh.execute-api.eu-central-1.amazonaws.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>region1.analytics.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>region1.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>slider-assets.cust.enpal.io</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>solar-slider.cust.enpal.io</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>stats.g.doubleclick.net</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>tags.creativecdn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>trck.spoteffects.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>uploads-ssl.webflow.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>westeurope-5.in.applicationinsights.azure.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.enpal.de</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.de</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.guenstig-heizen.de</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>guenstig-heizen@enpal.de</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>142.250.154.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>150.171.109.107</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.18.10.117</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.161.117</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.34.147</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>116.203.174.72</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.226.247.129</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.32.99.29</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.250.154.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.110.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.110.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.155</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.157</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.14.138</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.14.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.157.119</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.148</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>185.184.8.120</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>185.184.8.90</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>188.114.97.3</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>20.50.88.232</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>216.239.32.36</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>3.174.45.225</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>37.19.194.81</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>40.119.158.131</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>74.144.67.161</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>188.114.97.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.18.160.117</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>142.251.110.94</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.26.3.245</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>142.251.110.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>13.226.247.18</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>c2330841d0a8ad39aeb65b1bb62b6253bb35ea5c98f548c68f53b27904ee192d</SHA-256>
              <SHA-1>20cfa966968747ff6e1c596a9175815aa20ab39d</SHA-1>
              <MD5>e0eff9cc6378e21911695291335d302f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/svg+xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>cc72cb58b0a7690fc6f56fbabf97e78495653eac6655528e73bd16c0b44bf60f</SHA-256>
              <SHA-1>d484c0b042c24fad7bb738a197642262cff0d7d0</SHA-1>
              <MD5>8f00f2c9dcd09dcf777aa461ffcdb91b</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/svg+xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>dd95e73754d711b29c30a16ebcccf2d6d22eb52899f206895c38d32bbc7a2131</SHA-256>
              <SHA-1>37e1e29d4e7408405072a114a416efe7d45ca8b5</SHA-1>
              <MD5>44971b1d5272c13daac8672105110703</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>5d6d6a8bc2166e7062ce63ec0573cf6e46c022d8c1ceaa32e1ab760f37856d8b</SHA-256>
              <SHA-1>f307314824fc7afd33058de7305da5ff53d2445f</SHA-1>
              <MD5>d2ad7261b98abbb7b1071cd1154bb69a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/css</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>ad5146db96061613c14beedd7f9cbd4506f37d7bb6b7bd0f03bd816e696b5543</SHA-256>
              <SHA-1>4a5ffa0a05b033c57a06febb02c05dcdf9da748f</SHA-1>
              <MD5>6c94bc798fc4bd7e9b0efd07570e8b7d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>8b7d0de9f3df9103d70ed000c17b348240623ac4e4053d56fa0d5cfd8d74d79d</SHA-256>
              <SHA-1>fd1ce2d8e0999d8279b32211977bddeb04aed0d5</SHA-1>
              <MD5>6d1d67fe2715f25c2fd98a9011d8ea67</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d</SHA-256>
              <SHA-1>c8e1c8b386dc5b7a9184c763c88d19a346eb3342</SHA-1>
              <MD5>dc5e7f18c8d36ac1d3d4753a87c98d0a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>5b1d95059a217fcdc3415dd443941a550194083e20a3232bf30d694fc09ad73b</SHA-256>
              <SHA-1>9bf4c7f129046087f77daca298fd6bfa9a67f378</SHA-1>
              <MD5>f037a58bab78ed39ac12484440775ee8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee</SHA-256>
              <SHA-1>d3fa2564c021cf730e58ffddb138cf6b57ed126e</SHA-1>
              <MD5>7c96a5f11d9741541d5e3c42ff6380d7</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>04c766dc-198d-4a7f-d546-bcf1d7e571e3</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4180de1b-d6d8-7332-164d-ce94643be58e</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>510efa20-bcc6-9e4c-2139-993f0326b00c</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>510efa20-bcc6-9e4c-2139-993f0326b00e</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>510efa20-bcc6-9e4c-2139-993f0326b01a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>510efa20-bcc6-9e4c-2139-993f0326b01c</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>510efa20-bcc6-9e4c-2139-993f0326b028</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>510efa20-bcc6-9e4c-2139-993f0326b02a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>531276e7-eabf-75b9-4bcd-5161af049676</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>add3d447-31a2-807f-1483-cee7f86d94c6</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>c9693db7-bd64-debe-64bd-239b6113847b</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>cc264c2b-155f-283b-2ea9-ef2ab41344d9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>cdee8f2b-e33a-1061-f850-2db1851b1a4b</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>cdee8f2b-e33a-1061-f850-2db1851b1a4d</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>d60114d8-c233-e532-b871-42652ea877c8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>ef0a9450-1ded-cec8-e595-1be4025a25c5</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>ef0a9450-1ded-cec8-e595-1be4025a25c7</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>f9e61b6f-612d-1db6-9bb5-4136423221c5</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>f9e61b6f-612d-1db6-9bb5-4136423221c7</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://artikel.guenstig-heizen.de</name>
        <report_id>5585a233-8021-4f1e-963e-eeb888b60740</report_id>
        <tags>
          <value>html</value>
          <value>txt</value>
          <value>xml</value>
          <value>javascript</value>
          <value>svg</value>
          <value>obfuscated</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>fb64197670bbd94246e5b9f897a750db4dff3dc3b7081e97d185c2256720545b</id>
    <title>Analysis Report for fb64197670bbd94246e5b9f897a750db4dff3dc3b7081e97d185c2256720545b</title>
    <updated>2026-10-05T11:53:18Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38fe9d130e7ad452675d5</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac38fad766af099f2b39c8f</flow_id>
        <hash>fb64197670bbd94246e5b9f897a750db4dff3dc3b7081e97d185c2256720545b</hash>
        <iocs>
          <urls>
            <value>
              <url>http://hoiquantv.online:6606</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>MALICIOUS</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>hoiquantv.online</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>MALICIOUS</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>188.114.97.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>199cdbbdd8003a93f1901774ea9b55cfe05bc42c0de488cae3dec9033f5e2b8d</SHA-256>
              <SHA-1>74cf6c5a8b5929d7fafa30d6cdfd70a22ca2a622</SHA-1>
              <MD5>8937388e409306592d6717ff26fb8902</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>24aed8cd9dd33430708708fbffc0d9db5e6c3564b2146768ae7a875cb1cfbc2e</SHA-256>
              <SHA-1>e3e08d1d929abf9a8d36e12c6ed22dabf796380b</SHA-1>
              <MD5>086edb5f6c36a34b4f6f6debe3ea4bb8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>48d525c2ba3677f2a6c5091ae1f49b5801b62b1410617476a43b0eb49f3b9fd1</SHA-256>
              <SHA-1>7fc91b484610e7bdaf42d98cc8ba682a62b1ebf3</SHA-1>
              <MD5>abafcec6badd861dae997034739df3e4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>4ff1c75a93b2280dabe75acecade82d644388c9f4412565d846aeb396bfdc133</SHA-256>
              <SHA-1>6a55e1445c1c915664fba385828c5a0078fe460d</SHA-1>
              <MD5>f3d7095de1636559aa56ad81b25bbff9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>6ad9d2a4ce0bfec38454a93a896d1bc0a20df9f884059a502ac0a51b0f7ade9b</SHA-256>
              <SHA-1>4c52b4caf7f31a63860ff3f648456739abbc15f2</SHA-1>
              <MD5>9d8bbe6ef2116ed1cf2f36b31cceff51</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>9a14ffe356eb7ff73b4da61f8402bde3823a877227d5ab68ac569bc68df84396</SHA-256>
              <SHA-1>961fa5d9c84f56615aa1c4b492aedfcc226e7438</SHA-1>
              <MD5>9f3b4acfbd96a9f79e34116b9617915a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>a1f04c0ff3f00624286a084aa5f8acfd4fc6fa81de5cb54f5a1cbaff2f865320</SHA-256>
              <SHA-1>b91e7605d5ffb4ce68fc7582bf38f951889a9228</SHA-1>
              <MD5>de9434b651affc51661d88045d31eeac</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>ac35ad07fd04afd83957afbb93fd07a3b28845b44868d360bc44c3691d2e2a17</SHA-256>
              <SHA-1>7d6ab23ab1ad400caa6101717d672e7f765df239</SHA-1>
              <MD5>1100a17a9eb2346496cb8cf2ecf8704b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>d92e9af9c6c038f4da559e0ac30efc0427fa6915bf19efbd1fa05e5f2d8053ec</SHA-256>
              <SHA-1>1ebe62b065bfa230e0041ae850694c99e413f0e3</SHA-1>
              <MD5>f573e81dc7154adc71a17e8f9db3f3d0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>ddede0123042d7c2cb04fef5b97681305b96cb82090bd1542c34f65bd6fa958a</SHA-256>
              <SHA-1>cb65124f82054a26c36479436ef2eccce16d9236</SHA-1>
              <MD5>0e1fa9c5c3ffa6af1f61acdd1f6646f2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>eae9a65b090d08f80a28849db1265ff641cb2bfcbdaf1e83be0547c44ad5b1f3</SHA-256>
              <SHA-1>24720384c767e9084cd55a12cb6bd39f072ce9bd</SHA-1>
              <MD5>cf1a3fb00947dc25a5262b066f06e422</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>fa33db1a55a9917cb6e055330f51f8a3417fef815774fa5f45f7c288b4d9fe1c</SHA-256>
              <SHA-1>d1443fcbbf878b01303a6ccf228895a69d52fea5</SHA-1>
              <MD5>5f9cfdb51f1b6f9f34cd22ae002865f6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\</registry>
              <origin>DOTNET_DECOMPILATION</origin>
            </value>
          </registry>
        </iocs>
        <name>hoiquantv.online.exe</name>
        <report_id>eaa79fe3-7237-49a6-9342-6a012657f9e9</report_id>
        <tags>
          <value>peexe</value>
          <value>dotnet_pe</value>
          <value>asyncrat</value>
          <value>config-extracted</value>
          <value>remoteaccesstool</value>
          <value>anti-vm</value>
          <value>fingerprint</value>
          <value>base64</value>
          <value>reconnaissance</value>
          <value>lolbin</value>
          <value>schtasks</value>
          <value>obfuscated</value>
          <value>vbnet</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ad4ceacf9ec25f3de3da4e68cacaee39c09dce08c87d650b518309a3e23099d5</id>
    <title>Analysis Report for ad4ceacf9ec25f3de3da4e68cacaee39c09dce08c87d650b518309a3e23099d5</title>
    <updated>2026-10-05T11:51:29Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38f5ad130e7ad452675bb</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6ac38f3f766af099f2b39a39</flow_id>
        <hash>ad4ceacf9ec25f3de3da4e68cacaee39c09dce08c87d650b518309a3e23099d5</hash>
        <iocs>
          <urls>
            <value>
              <url>https://docs.google.com/drawings/d/14j5FMAuItniEHUxPKA-NjmbRqN9bwBpCEdig1FUjuhA/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1KilMosDyL7sbWD5ikgqTXI8laWOVfxfudYgXdbuELyE/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1_pOROAC2vO6qEIX3VOFLQfZyLEOr9OgMoiXTocegKmo/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1zP6Kcjm17Q3DEAW4XfK_PYq008qmIAQmk6ofjsqmcd4/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/14j5FMAuItniEHUxPKA-NjmbRqN9bwBpCEdig1FUjuhA/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1KilMosDyL7sbWD5ikgqTXI8laWOVfxfudYgXdbuELyE/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1_pOROAC2vO6qEIX3VOFLQfZyLEOr9OgMoiXTocegKmo/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1zP6Kcjm17Q3DEAW4XfK_PYq008qmIAQmk6ofjsqmcd4/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>file:///tmp/tmpgnn0w7jl.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/14j5FMAuItniEHUxPKA-NjmbRqN9bwBp</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1KilMosDyL7sbWD5ikgqTXI8laWOVfxf</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1_pOROAC2vO6qEIX3VOFLQfZyLEOr9Og</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1zP6Kcjm17Q3DEAW4XfK_PYq008qmIAQ</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>docs.google.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>docs.google.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>docs.google.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.14.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>cb30abf3d5dc5c5fd7cdd0a6f836cbf1254604819409e5dba937be6e5d220402</SHA-256>
              <SHA-1>0b7f40b58dd6452daf222887e1baf909625d30aa</SHA-1>
              <MD5>a392dfc7dd98e816b25ad20fcf94dd73</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/html</file_type>
            </value>
            <value>
              <SHA-256>ed0ecb43f4184b6fea9516694ede045592dc0812bce0a5daa6b8e106395f560c</SHA-256>
              <SHA-1>a63481f1002a5197a979bd9353ae1048c23ce251</SHA-1>
              <MD5>977c32aa27ba5583dc0107c15c9a668f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>ba8c615e0538c28f9fc155897c5fa15123a015dc6acd55efd7ace25ce06012d3</SHA-256>
              <SHA-1>b3938b923055088811eaed85223ef63b8ee6891b</SHA-1>
              <MD5>1bc4ddb9268566a7b254ae91a1c07beb</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>9061450f37faff9a07942d022e58d3d410f0a0efde5447e92acf6a7a1a9d0650</SHA-256>
              <SHA-1>0324235560b05d4eecbd8f73ec4cab047059baec</SHA-1>
              <MD5>7da9b9b294b39b94d1981789ad6fffee</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>cfa00aeb4fb308f2d5eff86ad21985968925ef55a8d9a79924c19f8209311d07</SHA-256>
              <SHA-1>a86108fff1735e36e1b44aa9cfc6b6cdd3953f85</SHA-1>
              <MD5>c8a442a6c7cea1866a68a3c62ca4ae0a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>c121ee4f019ad3470f761bc0ba090a4e0840e36177e48bb86cbcfc0aab0d8cbc</SHA-256>
              <SHA-1>9a898a1984f0fddc6103d567ed0da908780dca69</SHA-1>
              <MD5>5c9095c4f8550aa0beae038d3991a201</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>f57b5df2434ef7f4021f488e0de153cdb686d9092cc3d03f1e0806fa6f85b2b0</SHA-256>
              <SHA-1>6d1f7bfa9a520c0e9e04afafa09904b81ffc5dfd</SHA-1>
              <MD5>3643ac4aefcef119207dc14c21700cb4</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>5ebc65c608f5084ebd9186db1acf8383043ae2cc0fb3aea5facc77b47f439312</SHA-256>
              <SHA-1>e431c4d3aa825df9aba2add92851f75bdef2883b</SHA-1>
              <MD5>2ce07cce2c4b716cdae5ce0176414648</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>e468067115ac1541d7a051b2c3c286cd926e8e60a6007b361e7edaad074161e1</SHA-256>
              <SHA-1>bd0c72dd24b13c60607aec5c6744b83a2fd3ac02</SHA-1>
              <MD5>d1f358e11253acba8031b718a8da36b1</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </files>
        </iocs>
        <name>submission.eml</name>
        <report_id>901d5254-a0e5-485b-9f77-f1e18150e8ce</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T11:50:35Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38f1789017dd18dc1bfe3</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac38f084c2119a4a0856a74</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>2a502bc8-2cc5-44a9-878d-7cce17f63a0e</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T11:50:29Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38f13d130e7ad452675ae</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac38f03766af099f2b39911</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>ac2edd5c-abd6-4809-9fa5-08d680c4df0e</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>2e11d6592246d61d8d7cedbd669e6a4600d71460a8ccf49a932364acca7ab97a</id>
    <title>Analysis Report for 2e11d6592246d61d8d7cedbd669e6a4600d71460a8ccf49a932364acca7ab97a</title>
    <updated>2026-10-05T11:49:37Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38eedd130e7ad452675a6</_id>
        <file_type>application/x-sharedlib</file_type>
        <flow_id>6ac38ecf7e4998b7d617f6f1</flow_id>
        <hash>2e11d6592246d61d8d7cedbd669e6a4600d71460a8ccf49a932364acca7ab97a</hash>
        <iocs>
          <ips>
            <value>
              <ip>5.4.1.5</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>5.4.6.1</ip>
              <origin>INPUT_FILE</origin>
            </value>
          </ips>
        </iocs>
        <name>libZXing.so</name>
        <report_id>dba233e8-2f5e-498e-93c5-cfcc30510ee0</report_id>
        <tags>
          <value>elf</value>
          <value>elf-shared</value>
          <value>gcc</value>
        </tags>
        <verdict>UNKNOWN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>be31e6d1c0d8e472905592d8a162e23e1fc63a73e165712c9d0d4e81e14a31c1</id>
    <title>Analysis Report for be31e6d1c0d8e472905592d8a162e23e1fc63a73e165712c9d0d4e81e14a31c1</title>
    <updated>2026-10-05T11:48:58Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38ec6d130e7ad4526759f</_id>
        <file_type>text/x-jsp</file_type>
        <flow_id>6ac38ea9766af099f2b3974d</flow_id>
        <hash>be31e6d1c0d8e472905592d8a162e23e1fc63a73e165712c9d0d4e81e14a31c1</hash>
        <iocs/>
        <name>config_.ashx</name>
        <report_id>fbe4079c-ccab-42b0-92c3-b9c4d0e6cab2</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>b9ba4007ccc2174c5d71ff14693b17f1761447f5bebdf41ae78a239adf02dd03</id>
    <title>Analysis Report for b9ba4007ccc2174c5d71ff14693b17f1761447f5bebdf41ae78a239adf02dd03</title>
    <updated>2026-10-05T11:48:19Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38ea4d130e7ad45267598</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac38e814c2119a4a08569ed</flow_id>
        <hash>b9ba4007ccc2174c5d71ff14693b17f1761447f5bebdf41ae78a239adf02dd03</hash>
        <iocs>
          <urls>
            <value>
              <url>https://nra.adultscent.com/cdn-cgi/challenge-platform/h/b/jsd/oneshot/d76008a69eab/0.01485599954425254:1791198316:zA09v8MCvPC8Cs6Ly3X4KsI4v8dv5vIn4V1kdbMZ58k/a45c3278dc604da4</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://nra.adultscent.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/d76008a69eab/main.js?</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://nra.adultscent.com/challenge.php?t=MTc5MTIwMDkwNXwxNzkxMjAxMjA1fDM3YTUyYWNiOWJlMzM1YzV8NHxkMDg1MDcyMDkwZDRmZGMwYjhhZjk5OTIwNDlkMzVlM3xjNGMzOWJkOWU2NDk5MTlmZjMzNjIwMTIzMzdlZTZkYjMxN2FjMDk0ZDIwNzM1MzI3ODUyODE4YmZiMjcwNTQx&amp;r=Lw%3D%3D</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://nra.adultscent.com/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://nra.adultscent.com/verify.php</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://nra.adultscent.com</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>nra.adultscent.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>188.114.96.5</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxp://nra.adultscent.com</name>
        <report_id>0fc344d8-a3e3-4dee-9512-d61400ba8500</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>UNKNOWN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>fd2decbe13afad90618acaa12d6e6aa4eeb9155d3dbb80c429ceb2d5d00c4a09</id>
    <title>Analysis Report for fd2decbe13afad90618acaa12d6e6aa4eeb9155d3dbb80c429ceb2d5d00c4a09</title>
    <updated>2026-10-05T11:47:43Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38e8cd130e7ad45267593</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac38e5ddedbc9646d41c04a</flow_id>
        <hash>fd2decbe13afad90618acaa12d6e6aa4eeb9155d3dbb80c429ceb2d5d00c4a09</hash>
        <iocs>
          <urls>
            <value>
              <url>http://epicgames.com/privacynotice</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/exif/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/photoshop/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/tiff/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/mm</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/sType/ResourceRef</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/elements/1.1</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://udk.com/troubleshooting</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://udk.com/troubleshooting.</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://udkprofiler.epicgames.com/subscribe/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.iec.ch</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.unrealengine.com/udk/documentation/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.unrealengine.com/udk/documentation/.</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>epicgames.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>iec.ch</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>ns.adobe.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>purl.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>udk.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>udkprofiler.epicgames.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>unrealengine.com</url>
              <origin>INPUT_FILE</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>18.64.211.41</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>207.241.225.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>23.2.13.201</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>34.199.96.7</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>54.156.206.165</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>05124db06aa6cfa65b96e3579e31ebea335aaf77af66ca3136daf9a43b3b5353</SHA-256>
              <SHA-1>6e1ff5b5237400b5dc52dc7ba00bb877ed3f7199</SHA-1>
              <MD5>aebd6f3923dc1d64dae8d2769fcc214f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>0d8fe76af3584c65419fa1be04e15d47218a7dda7a63de7d8abeb9233117c1ab</SHA-256>
              <SHA-1>a9de1dddbf841be84b590ec0262052a9bd2c8afb</SHA-1>
              <MD5>55a77ffbd0a3bae8c2d0a2d2aaf76ec6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>159782a48a908176e7f210bc0146302a3a2223713c060405982321fbefd0ec36</SHA-256>
              <SHA-1>d4bee9eb8f8889248828a4b53b7a0c245f04cfcc</SHA-1>
              <MD5>fb60469a42fff655b73982d8c8a88db8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>203dc3d4920c20304aeabb84f7c99c7902d4e6a983a2c9b54b9578e619a7fe5f</SHA-256>
              <SHA-1>e5c7552ed2f8bcf5589979767e20d5d537645e83</SHA-1>
              <MD5>ba8ff74f13bec212f57652680503ad5f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>341a86a43a86a4fa34a8ac263f3507dcdcaa971340faa3f45ab9a682b8cc6020</SHA-256>
              <SHA-1>9a0f734d11589ddd42f5c279e528d6ee23393bae</SHA-1>
              <MD5>5a0d00e35dacf89ce64d1620c6281d34</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>3696fa793ad4ded9892e6fc196034b3face40f3be4a2667523e4051f95599079</SHA-256>
              <SHA-1>45c77daae6cd99cca6d10c4ce9ef53da865e5e52</SHA-1>
              <MD5>27fc15030b313a6fbba23060e62152ed</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>37ab77adc76ba539b5a51c958b17da30a20afcb52eda3c2cf704dfc89cc467e6</SHA-256>
              <SHA-1>f750cd3788cda792e89f429fc15ab4e4ccffeee8</SHA-1>
              <MD5>c7d01b39954c2e187ac841b429546f90</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>388f75e900f0c15fd66249d7b2e7edf6e14eeefb859e6f766b75058e44f27af6</SHA-256>
              <SHA-1>c5353cec27b30fb35e414dd5f3d0e9205aaf1c07</SHA-1>
              <MD5>bd62b6f553a2d1d012cc53fc325221d2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>504b14b5791d628218adfdb7fb7ce2ae97e705af88c2bcb522ec6509e96c111e</SHA-256>
              <SHA-1>6fdbc13aa19e2741114580db8c124bf57e51e0a4</SHA-1>
              <MD5>3e2d99c561662b512b15923ecff85ca1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>6cdb821034a565d2e4a3f8b665958effaff4610477758db0dd06216bdd264d71</SHA-256>
              <SHA-1>16abdb711d969f1c2f32598907ec1f1ac22eaa0f</SHA-1>
              <MD5>de49397d97608dfc5cd3531628bee0fa</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>73f330920960e74319b70adaf07096591a7775968a6b8dc17b4864591be63026</SHA-256>
              <SHA-1>a9379c6d9802d56ed0a7b182ffa05237c9288e5e</SHA-1>
              <MD5>20f96f976a87b5a2278640c40153ab7f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>7453686ab67068e51a1b36ddbc8ae55595fbdaf32abfae001e7e101cc6185ccc</SHA-256>
              <SHA-1>d6349f40356283ed8dd78b258b3fab50d0d5302b</SHA-1>
              <MD5>eb0ae538599a3981487a60319a56727b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>81cc0a6e1c8ef17dd6760a357f1b0ad86887d0e0423e408212ac4b99d5efa774</SHA-256>
              <SHA-1>81e2fa103e26897d9638d7fd7da960e75450a274</SHA-1>
              <MD5>f407a2a605ceb6b428820eff7d487daa</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>96d988ed413c42c7a3ad58dfbde9597a89ba7b94dbb46069e1d94b9679f42ffd</SHA-256>
              <SHA-1>53b3a0101c2a289d9c0b347709ddba11030f0650</SHA-1>
              <MD5>2bc58c95f5df160639b6188f634d55fd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>9891d60131ca93eabb7853a33fd86d2402a908276677391873b18e52817d9e95</SHA-256>
              <SHA-1>10f597f75248343a7f0186d5be5153b2244baa08</SHA-1>
              <MD5>53ab96b073361790f696caeecc48df7c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>a6fc1a6e344cf35bd6e516b93cd4215511d8f43aede05b6d05c943decaea145e</SHA-256>
              <SHA-1>70688aa543f09316bd3f1a6539ce9551ca9222e1</SHA-1>
              <MD5>4b7c50a7afd22aa8c4b2fb3c6e32ca5e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>a8fd9ec193e13942e9051b5e56192f75e85d40e12358bb31476ae1ed377cb361</SHA-256>
              <SHA-1>27d6dd13e003fc9df80e66d6c8e4f9d35c58fad5</SHA-1>
              <MD5>30bd8d8bf34222cbd32a944eafb07d55</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>af12e6878a1c1c1472409362bbf2aab8ee649923919ba385be50c753c57b1146</SHA-256>
              <SHA-1>9136c36e077e8d33a4c4dd1a32f1a45cc1cffe87</SHA-1>
              <MD5>caa1e1f14fa4f316ec34b4430762344b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>b9ed2084048566af7f7ae2d3231ac55df22572b2c950f2c27a5ee1b35c2ace82</SHA-256>
              <SHA-1>29101667502a7aab8285718c743ecef6e8768daa</SHA-1>
              <MD5>b09a26447c8a94a73c8f816d0d5752fe</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c2ae9a03e4db3addd8356852a4d54e59e9d5ab2b800047d07d1274a545c7be0a</SHA-256>
              <SHA-1>4c6ca436652a26c855cf2b254eeba14ca7973372</SHA-1>
              <MD5>5d535055443f7f032cd61a7ff432d5db</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>c97473c03e70f01b30868c7fc67c23043cf8d8f6a8d4240725d52836be65f69b</SHA-256>
              <SHA-1>a202473df8b736303ab5f1eb4d93e167589cec4e</SHA-1>
              <MD5>62a1e84c1d90eeb8d4ad4fc2387448e1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>cd8ec2836d4421bd6647f4c00f8f0ac8cb8fed73dd6522fdaa91ae0112284d30</SHA-256>
              <SHA-1>d1d1bf20d32380e2350614624ba828036b158001</SHA-1>
              <MD5>eb756706bdfdcc4850e27d46322082a7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>ceffc569f10ab622b1d14a64ee074898f470f0bea67937a96cfa44c826192c76</SHA-256>
              <SHA-1>f3d54ae2b978c609b602608c2286f6693738b46c</SHA-1>
              <MD5>249ec48cac323138a2cd6a7378706f10</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>d05c251d62a319173214d7febf12088923c20c03eb7d8c3ea61380d7dee3c6fa</SHA-256>
              <SHA-1>bcce03cd3620b2ef6a05e779ae6afd6599dbd96f</SHA-1>
              <MD5>65d3454c74e47856c667c31e3e8eea90</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>d6aa3c00684241f3fd06200eadc8dfba32c6d96cea1b6ac0b9c3d09459eded60</SHA-256>
              <SHA-1>915353f4f0aa4dfb79383fd26b054eeefd3999fc</SHA-1>
              <MD5>94f9e8ee1039f458d67b5593e320ee65</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>ded4e8b603a7496b88aa7328fbd294129fe089451a1220097dcae37a2fd70b52</SHA-256>
              <SHA-1>a1c47a0604089b98aaec26ce0a94bfe28a3b3da3</SHA-1>
              <MD5>28f83c5caae48ab440caf9c358a6fa56</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>f0436c838bb382b12740efec6a481ddcd72f4ed2665cb35d6de256fc15a59713</SHA-256>
              <SHA-1>8763f4251bba29d489c83b58c736f3cc27c4176c</SHA-1>
              <MD5>9a03c311c4d485afcf03e875751ca157</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>f888b504e36182421f71f0b65110d48be9a2e1a2364a0f7a6e3c27f1ba9fa51a</SHA-256>
              <SHA-1>da0d90146c3d71724d27aa8a576cc5b66fe1dea8</SHA-1>
              <MD5>3393586ef778fc78d3574d9dab5b49fc</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>fc6b7fd58d8922cba9ab41dc0fcbc55daba3ca65fe1762f99ccdf4fcd537d362</SHA-256>
              <SHA-1>d2a97d38ca04bc95f25b4b4a3d9e6bafb3696fef</SHA-1>
              <MD5>32f3b19680b055b9b396bbb36fbe176e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f</SHA-256>
              <SHA-1>7897418f0fae737a3ebe4f7954118d71c6c8b426</SHA-1>
              <MD5>eb701def7d0809e8da765a752ab42be5</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>2acea6c8b9f6f7f89ec51365a1e49fbd0d8c42c53418bd0783dbf3f74a744e6d</SHA-256>
              <SHA-1>92f32e74944e5166db72d3bfe8e6401d9f7521dd</SHA-1>
              <MD5>c234df417c9b12e2d31c7fd1e17e4786</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/vnd.ms-cab-compressed</file_type>
            </value>
            <value>
              <SHA-256>417eebd5b19f45c67c94c2d2ba8b774c0fc6d958b896d7b1ac12cf5a0ea06e0e</SHA-256>
              <SHA-1>8417886d47c19cf6892f4080ddd5aaa1a49db3e9</SHA-1>
              <MD5>f7f554aa613eccf065575b8c69717ef7</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/vnd.ms-cab-compressed</file_type>
            </value>
            <value>
              <SHA-256>4afe0249a13868b7c4a92b4d53c998adf6053eb5e2c47fd81020fd8d4bb11150</SHA-256>
              <SHA-1>d8d857ebbe2c0dd5b63e564bf8428c55ece55778</SHA-1>
              <MD5>4b4f83d1dd86314b65760f44f9c7a9b1</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/vnd.ms-cab-compressed</file_type>
            </value>
            <value>
              <SHA-256>51500283f69e97f5beddb073ba2a9017de3d30379c0dcc4d11dd2236ce07b317</SHA-256>
              <SHA-1>358e429ac3b125cc7fe4f9ea46cdca4583cbb1a9</SHA-1>
              <MD5>edeb828a8e54a9f3851007d80bc8dd6e</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/vnd.ms-cab-compressed</file_type>
            </value>
            <value>
              <SHA-256>66b797b3b4f99488f53c2b676610dfe9868984c779536891a8d8f73ee214bc4b</SHA-256>
              <SHA-1>b84b83a8a6741a17bfb5f3578b983c1de512589d</SHA-1>
              <MD5>cede02d7af62449a2c38c49abecc0cd3</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <SHA-256>7b4332207563beba1103744b6db5399ad150e9e6838f9d5a71497e7eb3645ebf</SHA-256>
              <SHA-1>2df40d48c69d7cfb4e0c19f07a019f5f123303fa</SHA-1>
              <MD5>9d2da3b1055120af7c2995896f5d51ed</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/vnd.ms-cab-compressed</file_type>
            </value>
            <value>
              <SHA-256>832b6d48e169b4725ae482ea4d1c3360a09631a89b2fac3aba81a50805a50adc</SHA-256>
              <SHA-1>fabca8c0aa28164ef4fdb7ee4ae8942a275b1713</SHA-1>
              <MD5>db47136a200e326174ce790359596eb6</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/vnd.ms-cab-compressed</file_type>
            </value>
            <value>
              <SHA-256>8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d</SHA-256>
              <SHA-1>9fd00f3bb8a870112dae464f555fcd5e7f9200c0</SHA-1>
              <MD5>bf3f290275c21bdd3951955c9c3cf32c</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>a58cefe822e371d078eaf89319f832693352ba7d62079320074397f0f3425961</SHA-256>
              <SHA-1>66d12509137f2b5e1a668df39e6ccce6402822c3</SHA-1>
              <MD5>758c5a459978cb2c68a300a60da153be</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/vnd.ms-cab-compressed</file_type>
            </value>
            <value>
              <SHA-256>acba5c4d4ac90e1df1c8404be5ff780e24238153cb410af909cd4364d213f2a9</SHA-256>
              <SHA-1>c6ee8cff225019a93308c896146d94b00fd5417e</SHA-1>
              <MD5>88dfbb4c1876e80a1864265c61c7a7fd</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/vnd.ms-cab-compressed</file_type>
            </value>
            <value>
              <SHA-256>c1d0d56b83bfb09a5e1a89e1898bb74446a847b30a968f3664ec2d87368eb63e</SHA-256>
              <SHA-1>9439907a1000b9dcb8989ffbd828e6294c277fba</SHA-1>
              <MD5>96e7847a914afcb489194940b06a5c23</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/vnd.ms-cab-compressed</file_type>
            </value>
            <value>
              <SHA-256>c6cd2d3f0b11dc2a604ffdc4dd97861a83b77e21709ba71b962a47759c93f4c8</SHA-256>
              <SHA-1>027d0c2749ec5eb21b031f46aee14c905206f482</SHA-1>
              <MD5>cbe0b05c11d5d523c2af997d737c137b</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <SHA-256>d3ec032bd6e777f9921cca95eb1e838a67dec017ad22c1e2eef7cd1408acd337</SHA-256>
              <SHA-1>b438800af30f36ce91bc40dced5752081d34a8ba</SHA-1>
              <MD5>5663c13a59817ad3b1b30b2d5efdf484</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
            <value>
              <SHA-256>dc288edf0bdde59ecfd79629941238968513932ce6ba93a60c659d1240dc166c</SHA-256>
              <SHA-1>2b67b0adb2d9b980474278308a693bc2db44f38d</SHA-1>
              <MD5>1e4d267f9de2833d39791d972c3be227</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/rtf</file_type>
            </value>
            <value>
              <SHA-256>e18a5404b612e88fa8b403c9b33f064c0a89528db7ef9a79aa116908d0e6afed</SHA-256>
              <SHA-1>5885ece90970eb10b6b95d6c52d934674835929e</SHA-1>
              <MD5>d495680aba28caafc4c071a6d0fe55ac</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/vnd.ms-cab-compressed</file_type>
            </value>
            <value>
              <SHA-256>e7a09f8235cc587cc63f583e39fbc75008d9677c8bb4dcc11cb8d0178a5153ac</SHA-256>
              <SHA-1>26b3616d7321978bd45656391a75ee231196a4a2</SHA-1>
              <MD5>743b333c2db3d4cf190fb39c29f3c346</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/vnd.ms-cab-compressed</file_type>
            </value>
            <value>
              <SHA-256>f6d3e7169e4fb85c67de2d4f22486251a235f9539012878fb0faa77aaaf7a018</SHA-256>
              <SHA-1>459eb3a9a88d5f742210be214f3e729a51834244</SHA-1>
              <MD5>e08209012cfbc788660179ca13dbc18f</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>fb0e534f9b0926e518f1c2980640dfd29f14217cdfa37cf3a0c13349127ed9a8</SHA-256>
              <SHA-1>76c4bd2d8f359f7689415efc15e3743d35673ae8</SHA-1>
              <MD5>d8fa7bb4fe10251a239ed75055dd6f73</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>fcc6cf0966b4853d6fa3d32ab299cde5a9824feaecb0d4f34ea452fb9fd1c867</SHA-256>
              <SHA-1>bce9f21cdb1e101c7223c9e62eca61ec22d6bb81</SHA-1>
              <MD5>7749862c307e527366b6868326db8198</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/vnd.ms-cab-compressed</file_type>
            </value>
            <value>
              <SHA-256>0d773adf06cae22601d2f6e5a2dd0d1895b590ef93057edc1541e021591163ec</SHA-256>
              <SHA-1>8621a91d09c865e8e7cfee94e9e5b53a072fcbe1</SHA-1>
              <MD5>d5b095740057e11ff79032c5b2016f7c</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>444291b233deef86923c286b9df938dc77e06f7531929c8ce4fe399167221938</SHA-256>
              <SHA-1>54d0c125f083c8c28c05ac965a3b4e23d3d6574d</SHA-1>
              <MD5>df0b061be89049463adeb3ed927f76aa</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>5c62db0428688a93ceb32e6552e1e8d3b5315e13de83ad4d31e04b5cb8d984b4</SHA-256>
              <SHA-1>f95153d496c13ffdda8eb8a6ab6b1c138e7bd3c4</SHA-1>
              <MD5>ce99849c841f8d5f1cbf455b79e5e7b7</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>5e6bddfb10f1ada8442278928643c0812ae4b1b4a50af572ffbef337241b13c6</SHA-256>
              <SHA-1>38fb575bbe42d129a6f3b6fb191b3e232006a28c</SHA-1>
              <MD5>17f7d3e4370d25d10116d3119280b16d</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>6f150b4e06b7c326fd90e5f8e7e66efbad90387d8af8d684e808faa123631d3d</SHA-256>
              <SHA-1>a5bda3b4c9c021b45ff2dd296fa4f5fb0abcf026</SHA-1>
              <MD5>90abfa415eaba5050b5f371c49073cb6</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>c16f76b32858a53a45f2e5fad7ae54cf213f5727729449ff72da3939bb2b4386</SHA-256>
              <SHA-1>240375c4ff1f69cae0cf8c6f36e17a6b446381e0</SHA-1>
              <MD5>e6ab02271ff7f5946c24beaf399d956b</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>ca830c10d7f795a409409bc48001a76ed6486f53b622a15e217cfc6b587625b4</SHA-256>
              <SHA-1>583b83d0fe699b81b8cd1c129e07f8d8afff53a4</SHA-1>
              <MD5>76fc15db2a8d417d6b0fd32cd261a336</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>ce63684ab3698880f49520fe7d6b96f2d4bd7d8c3105c772bcc3d5fde18d1b46</SHA-256>
              <SHA-1>b7cbe3aa4c8b67eba5c66d5ce9c9ff8a80e03188</SHA-1>
              <MD5>10bade4ede4b40a3ebf9e1087245497a</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>d7a92cfd1155f6d578c53461d33b4e03e8327a2f2d10e2de11c5629917868771</SHA-256>
              <SHA-1>059b12bd439ac127d9404814d33836dab5adc54b</SHA-1>
              <MD5>0626ee0c36d73fadee8deaa94659a821</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>dfb73d4d855886e1ced0b567e133677087fdeb0fa04378bd175623386cc1d4be</SHA-256>
              <SHA-1>3e6f10ad39c50ba3c2c647115632eed0013bb33c</SHA-1>
              <MD5>c5696d2656a40f73d4b60bdd32a13b60</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>8d0dfa1eed1164cd074074ac271c0fc66f2c4fecdabf678c341a5c4e21bc5e71</SHA-256>
              <SHA-1>3802c4afa57ce0344eef23cd741059743e0df7b2</SHA-1>
              <MD5>0acb0d437ac5059e36ad48a2ee1feee9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>fb32e12fa9bee1379acc0cf921ba7e79a6b85bd46253d993db0898847b9870a1</SHA-256>
              <SHA-1>5afcdba7bf49ea157775201417cf4ade57f0e4b2</SHA-1>
              <MD5>395be4539ecc2498cec2fdae80e8600e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>14CDE1D4-C871-45DA-B438-DB78EDAE1063</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>A5A61107-78AD-4A6F-A0C1-FDEBC431A9F8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>SOFTWARE\Epic Games\UDK</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\RunOnce</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>System\CentralProcessor\0</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>UE3Redist.exe</name>
        <report_id>020c2966-1251-41ff-a59c-678a4a8c6696</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>anti-debug</value>
          <value>fingerprint</value>
          <value>evasive</value>
          <value>lolbin</value>
          <value>rundll32</value>
          <value>packed</value>
          <value>reconnaissance</value>
          <value>runonce</value>
          <value>adaptive-context</value>
          <value>overlay</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>expired-cert</value>
          <value>CAB</value>
          <value>installer</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e000b6ed57da48da099dff02a9fbef8eea9fd0c4ed0abdf6f7dc2ce2826cf9ae</id>
    <title>Analysis Report for e000b6ed57da48da099dff02a9fbef8eea9fd0c4ed0abdf6f7dc2ce2826cf9ae</title>
    <updated>2026-10-05T11:46:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38e0dd130e7ad45267579</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac38e047e4998b7d617f460</flow_id>
        <hash>e000b6ed57da48da099dff02a9fbef8eea9fd0c4ed0abdf6f7dc2ce2826cf9ae</hash>
        <iocs/>
        <name>9968778_35683535-bfcd-4d7c-86dc-249b81f50d3f@9968778</name>
        <report_id>f63b4dac-59c6-4c65-a043-d121b980c311</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T11:44:29Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38daa89017dd18dc1bfa2</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac38d9d7e4998b7d617f334</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>9bc11a42-93d7-4acd-a7ca-b73e9f518cae</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T11:44:26Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38da8d130e7ad45267564</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac38d98766af099f2b392fd</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>565a7f74-d13a-4cbe-ad24-46728e166f99</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>35cb68744799d035932b24b8d1da6d10b1571d7072a96a9f29be0852431b0784</id>
    <title>Analysis Report for 35cb68744799d035932b24b8d1da6d10b1571d7072a96a9f29be0852431b0784</title>
    <updated>2026-10-05T11:44:23Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38dc6d130e7ad4526756c</_id>
        <file_type>text/x-ini</file_type>
        <flow_id>6ac38d96766af099f2b392f7</flow_id>
        <hash>35cb68744799d035932b24b8d1da6d10b1571d7072a96a9f29be0852431b0784</hash>
        <iocs>
          <ips>
            <value>
              <ip>10.1.20.20</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>10.1.20.20</ip>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </ips>
        </iocs>
        <name>BaseEngine.ini</name>
        <report_id>f31ff40c-256d-47aa-a25c-284c2dfa610e</report_id>
        <tags>
          <value>txt</value>
          <value>ini</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>594951a8d124efee600636f9245629795858de648d88c33002bc45c62051aafd</id>
    <title>Analysis Report for 594951a8d124efee600636f9245629795858de648d88c33002bc45c62051aafd</title>
    <updated>2026-10-05T11:42:44Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38d8ad130e7ad4526755c</_id>
        <file_type>image/jpeg</file_type>
        <flow_id>6ac38d317e4998b7d617f254</flow_id>
        <hash>594951a8d124efee600636f9245629795858de648d88c33002bc45c62051aafd</hash>
        <iocs/>
        <name>Picsart_26-05-13_10-40-49-526.jpg</name>
        <report_id>5ed81e80-6e3f-4e6a-91be-39491d19b7c9</report_id>
        <tags>
          <value>jpg</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>b07ffcd0af80f6b9fba09abe816ba2f0ff0d336639f1768fc317291bc635ece6</id>
    <title>Analysis Report for b07ffcd0af80f6b9fba09abe816ba2f0ff0d336639f1768fc317291bc635ece6</title>
    <updated>2026-10-05T11:42:07Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38d78d130e7ad45267557</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6ac38d0f4c2119a4a08568e0</flow_id>
        <hash>b07ffcd0af80f6b9fba09abe816ba2f0ff0d336639f1768fc317291bc635ece6</hash>
        <iocs>
          <urls>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/CSPCA.crl0H</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/tspca.crl0H</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/DirectX0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/CSPCA.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/tspca.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>crl.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>23.2.13.201</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>daba3b21560f8a41a7a8cf2f81bacecb77509ed39cad51d2cf4ca542612f4a58</SHA-256>
              <SHA-1>de014ce4817ae61746b798c05e373de3f91d75de</SHA-1>
              <MD5>a76c48f4c0b43325ad9e0c1501559bb2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>4E5BFBF8-F59A-4e87-9805-1F9B42CC254A</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>BB2E617C-0920-11d1-9A0B-00C04FC2D6C1</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>ECDD6472-2B9B-4B4B-AE36-F316DF3C8D60</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\Classes\Software\Microsoft\Windows\CurrentVersion\GameUX\GamesToFindOnWindowsUpgrade</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Classes\Software\Microsoft\Windows\CurrentVersion\GameUX\GamesToFindOnWindowsUpgrade\%s</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\GameUX\GamesToFindOnWindowsUpgrade</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\GameUX\GamesToFindOnWindowsUpgrade\%s</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\%s</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>GameuxInstallHelper.dll</name>
        <report_id>f576669a-b53e-4da9-863b-9afba0e4f18d</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>explorer</value>
          <value>fingerprint</value>
          <value>lolbin</value>
          <value>reconnaissance</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>anti-vm</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a774b0bdc3d83d98ac3c142ad48a96aed60e9c6c7ccb6f2869a8170bc93aca7a</id>
    <title>Analysis Report for a774b0bdc3d83d98ac3c142ad48a96aed60e9c6c7ccb6f2869a8170bc93aca7a</title>
    <updated>2026-10-05T11:42:04Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38d8fd130e7ad4526755f</_id>
        <file_type>application/pdf</file_type>
        <flow_id>6ac38d097e4998b7d617f190</flow_id>
        <hash>a774b0bdc3d83d98ac3c142ad48a96aed60e9c6c7ccb6f2869a8170bc93aca7a</hash>
        <iocs>
          <urls>
            <value>
              <url>https://ag.org/-</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://anglicanchurch.net/wp-content/uploads/2020/06/To-Be-a-</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://digitalcollections.nypl.org/items/634ad849-7832-309e-e040-</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://hymnary.org/text/my_god_i_love_thee_not_because.</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://kinginstitute.stanford.edu/king-papers/documents/mans-</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lccn.loc.gov/2024043571</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://t4g.org/resources/greg-gilbert/what-is-and-isnt-</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://web.archive.org/web/20240417174435/</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://web.archive.org/web/20240519082846/</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://web.archive.org/web/20240725234831/</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.lawyerscommittee.org/proud-boys-ordered-to-pay-more-than-</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>ag.org</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>anglicanchurch.net</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>digitalcollections.nypl.org</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>hymnary.org</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>kinginstitute.stanford.edu</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>lawyerscommittee.org</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>lccn.loc.gov</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>t4g.org</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>web.archive.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>SpecialMarkets@Zondervan.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>customercare@harpercollins.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>140.147.51.12</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.20.27.253</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>149.126.77.174</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>141.193.213.10</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>138.199.36.8</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>141.193.213.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>207.241.237.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>35.188.211.54</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>23.2.13.58</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>110348732323fc5448c1065df75019c4f9e00e77acb7f0a7d6e46a5e335d973c</SHA-256>
              <SHA-1>e4c34bb83d7fa86d392b9715b514b23879b51d9e</SHA-1>
              <MD5>c21d30958e9ae9c6fa06b763d39c59b1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>c0fc2382292dc610bfaa5681bb87262b9eb140a6c84ca22fd49da18b7ae77334</SHA-256>
              <SHA-1>9f528c0c2de3da1aeb1b107d0609f4b25ee04790</SHA-1>
              <MD5>d2793c403c436d49a5089a84e930ba9e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>d02032286070b4dd9d8fbd985a7bdca8af8edf52b89ff177db3bfcb2c8a9c43d</SHA-256>
              <SHA-1>cf79e1a0b6f763060a526886494db0b1b2e053b7</SHA-1>
              <MD5>185dd5ec503c683da355a50e70f25c68</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>9c27df28a51eae5842dc966094df091427a7ec60372c2338eb643f3c465b2a45</SHA-256>
              <SHA-1>01a40dc2e58f76faae6b0f9daed00517f3a30cb2</SHA-1>
              <MD5>d8ac9d2b58192219fbb7bd520bb27f20</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>b2e08b84f67d39a18de0dc74e12d5da084bb843f7f833f940c3329ece21eab43</SHA-256>
              <SHA-1>687e2f1b475346605215c18e5f388e4f790d48f3</SHA-1>
              <MD5>b343db26ef4fb08997fffc75edb2f34a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>a859208554c827b167773762fc6eb6a69db21f6100972c9e40eed7146bcd16b2</SHA-256>
              <SHA-1>fced666fd31f0dcd4d1f2eef84d220e6a45e254f</SHA-1>
              <MD5>751b4a13a04196c8e713a5bfe87c59c5</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>65866c6d7404d26d30f6a0278a49dd91246e6d7ec5fcf6037df7f9c69c9c9a70</SHA-256>
              <SHA-1>bbc6417d68f1086dbb70af593b228b8f4d1db86a</SHA-1>
              <MD5>ecfd6c140d96e1afc3eca940e498c4e2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>e859c18f0c0cc71ffed35c4e7ebc87cbb4f136116156f2de1588aeb71449533e</SHA-256>
              <SHA-1>c94415808db2565fb39f56dca32171784f9b5ae0</SHA-1>
              <MD5>10b8e71e6bf8f0c294bae4c7b34cf18c</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>_OceanofPDF.com_Five_Views_on_the_Gospel_Counterpoints_Bible_and_Theology_-_Michael_Horton.pdf</name>
        <report_id>ef18a538-e3f6-45e1-9bfd-51637d29f003</report_id>
        <tags>
          <value>pdf</value>
          <value>html</value>
          <value>txt</value>
          <value>anti-vm</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>c8e529043d56348624322a8c852dc79960f3a328c1bdd0f910e66d5f5c364b4b</id>
    <title>Analysis Report for c8e529043d56348624322a8c852dc79960f3a328c1bdd0f910e66d5f5c364b4b</title>
    <updated>2026-10-05T11:42:01Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38d63d130e7ad45267552</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6ac38d087e4998b7d617f188</flow_id>
        <hash>c8e529043d56348624322a8c852dc79960f3a328c1bdd0f910e66d5f5c364b4b</hash>
        <iocs>
          <urls>
            <value>
              <url>file:///tmp/tmp2foa0iry.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>file:///tmp/tmp2foa0iry.html#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/?url=</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:rosemary.lally%40altisource.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>2Fdeveloper.salesforce.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>2Fgraph.microsoft.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://login.microsoft.com//////////////////////////////common/oauth2/v2.0/authorize</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://login.microsoft.com//////////////////////////////common/oauth2/v2.0/authorize?state=cm9zZW1hcnkubGFsbHlAYWx0aXNvdXJjZS5jb20=&amp;scope=openid+profile+https%253A%252F%252Fgraph.microsoft.com%252FUser.Read&amp;prompt=none&amp;client_id=2ff7debb-de95-461d-bcdb-514d4156c247&amp;uri=https%253A%252F%252Fdeveloper.salesforce.com%252Fdashboard%252Fsession%252Fuser%252Fverify%252Fstep1&amp;%255Ca3edq%250C+2e4c%250D%250A%2593bb66f835%2509%258C2979X%25BCint+Builder.Decode%250A%2509Context+%253A%253D+FlowEmail+%255B+OffsetStream+%253A=%2520Token%2509Data%2520%257C%2520Email%257Dfor%2520Stream%253A%253DPayloadBuilder+;+ValueContext+%257D+Trace%250A%2509Decode+.+SignalVector+%257B%2520Offset%257D%250Aa78c998ef06b569e%2597%25E9%252A%25CBa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053evar%252BVector-Secret%25250A%252509Decode%252B%25253B%252BBuffer%25250A%252509Encode%252B-%252BSession%25250A%252509Decode%252B%25255D%252BPayload%25250A%252509Offset%252B%25252B%252BBuilder%25250A</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>nam04.safelinks.protection.outlook.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>login.microsoft.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>rosemary.lally@altisource.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>0fbf47bf-1674-46a9-8b15-cc293323daeb@CY6PEPF0000004D.namprd03.prod.outlook.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>rosemary.lally@altisource.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>rosemary.lally@altisource.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>rosemary.lally@altisource.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>10.167.247.138</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>198.46.243.200</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.190.160.2</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>1170e2b2f0ce4ddbd925d0c34c3be70cf49b230a437f60fe83f657ffebc6677b</SHA-256>
              <SHA-1>273cde1aeadf7bf6a7d90019f6408d59854a2579</SHA-1>
              <MD5>7809dbb7b7a5b148be6ece83972ef87e</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/markdown</file_type>
            </value>
            <value>
              <SHA-256>8f77f1f31fdd44dea9563787e8ca34e4fb253ed9a329cb40f7f39ba67756ac70</SHA-256>
              <SHA-1>d1e41828086215d72ffb24a0b3baf0640dc6d4f5</SHA-1>
              <MD5>ccd2ed8f06c5b4f9255ce7f63d1f6ccb</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>7ff112d44d5ce109d5c849d6b20e197dc5b1348ce3ff60c04b0372b5716c7024</SHA-256>
              <SHA-1>c79cbd4b0fb736a1cf10431a641f9ddfe1639602</SHA-1>
              <MD5>0c70470f7954739cb83eafef72b92cd9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>2ff7debb-de95-461d-bcdb-514d4156c247</uuid>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <uuid>2ff7debb-de95-461d-bcdb-514d4156c247</uuid>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <uuid>0fbf47bf-1674-46a9-8b15-cc293323daeb</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>1b3e89d8-7681-4c24-8969-363a4fbd0a7a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>617420f1-bbae-48cb-828f-08df22d1d69f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>2ff7debb-de95-461d-bcdb-514d4156c247</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>attachment.eml</name>
        <report_id>433f3798-c8b2-4af0-8157-9710905ab1b3</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
          <value>html</value>
          <value>obfuscated</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>c71fd207b1df1fe9dfcbaa0a8c7a02ea9dd878b98a2481c63af2da4857bd7ac4</id>
    <title>Analysis Report for c71fd207b1df1fe9dfcbaa0a8c7a02ea9dd878b98a2481c63af2da4857bd7ac4</title>
    <updated>2026-10-05T11:41:16Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38d47d130e7ad4526754b</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac38cdb36412e623d2c98ba</flow_id>
        <hash>c71fd207b1df1fe9dfcbaa0a8c7a02ea9dd878b98a2481c63af2da4857bd7ac4</hash>
        <iocs>
          <urls>
            <value>
              <url>http://www.redbarrelsgames.com/support.php</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>redbarrelsgames.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>141.193.213.10</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>115564c7e38a28a11e9152e8924d2644c0dc7d900b932de4bb1ba8a26efbd7e4</SHA-256>
              <SHA-1>20601e3659fb96018c7446dcf8358a2302d72638</SHA-1>
              <MD5>674ae7c4d0ecc48448d830b34f7e377a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>1679152ac60417707797f923e038c7a4113f7c2ff78efd920dfbfbbdbdf008ea</SHA-256>
              <SHA-1>f3e3a408b8ef90ebaf1527fa8483b0c40f6d9766</SHA-1>
              <MD5>0bb22968dd68246dd0183174897beb41</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>199dcca531fa7d3109bf4553e945b95b2cc0572f0ed9e8d55d26d53be6bc89ce</SHA-256>
              <SHA-1>450571ce49a005466cf8db04502b21001ec0c2fb</SHA-1>
              <MD5>ee7d6a8411b9a4d467d6b6b50ac0b7e3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>1e279f0ccdca0dd02619c6ece68325947f6f071efdbbe97f409c8133259c406b</SHA-256>
              <SHA-1>47e1537f2f69437f9a94d7350288a49798513afe</SHA-1>
              <MD5>4066261e8d4383d21b3416fc048a538f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>48187f26931c9169b1dc29c99cab1cecfb97ed15ef104dae2ca94ca238d0063f</SHA-256>
              <SHA-1>36ec337bd915a700b114c9b32fc5a811564ebce2</SHA-1>
              <MD5>aea9cc243c68e01d4a9e53c493fd27c1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>495e0c57407030da51bf0cf0a4ab94113551dce978c32eaa7ab4db05660b9151</SHA-256>
              <SHA-1>ff9ec0afb6a7f05e4d75117d637c30d6d79d299f</SHA-1>
              <MD5>b9ccff0355b9e786c6cc2679daaf788f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>547a2b60c9db80051e97fd2a6d5ac1301a9d03c17b5ebaf4ae8151c01177e48c</SHA-256>
              <SHA-1>dd303eb40fae556902032dd33afb49a5f5bf814b</SHA-1>
              <MD5>c8117995cf2b69fd38ef55fbf05b3bbc</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>5b3f70ea7a6ca78723dcd8f25d6323cd04ec2e4f755cdf458c8599f8d5f6f9de</SHA-256>
              <SHA-1>5de3aea92a6fcfa0f3fbf421479ec072cfbf451b</SHA-1>
              <MD5>ba4854b9e46ab989da8288fa7e840163</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>8054a5345637d0ba42a84bffc639664afdec4892eb8a1087233c9b685bc77289</SHA-256>
              <SHA-1>7023c9404f8cdcda690182c4a57b0d32dbd67775</SHA-1>
              <MD5>19be41f3259ce2a6ba4fee1e01812dc3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>a88dfe795f0208e02fb2f8b924bdaab7ab89bdf61e41e640ca4e4eee5b4eb381</SHA-256>
              <SHA-1>d0cee3656bb4244969c0b416e6df0915d317c957</SHA-1>
              <MD5>a4a8b1eb86614169c1c7692e30def644</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>b0220a09935a31a5a03610f19c43a47fd3f8b7fc199df23a8c9730362b041419</SHA-256>
              <SHA-1>1526809dc61da1811d64c7eb2b163109f0aa758f</SHA-1>
              <MD5>704c4194b3e2b32317dd2de0a890898c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>b570c53545332093746c6207ae287058e5eeda54d27c39ffdd0a7d68e2133835</SHA-256>
              <SHA-1>77bc75625f3fb80ebcc6b9ce602804ec0ad83c00</SHA-1>
              <MD5>6e402cd25f09e27f5ca684e6661e87b1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>c18f203fe3ae43e1e1093c9b9ce3417469eef1b6a25c3def173c8d8a53a1f549</SHA-256>
              <SHA-1>3097f5fb2b50c0b77906c0494498f1ce0f82bb7f</SHA-1>
              <MD5>81e2bef321a9ee40f66a8c4cc0808015</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>c5ee824649009a31d12ae205c3a64cb5187e516855eaf9fd21a6dec2f359c3ea</SHA-256>
              <SHA-1>3dd15936ac88c1ccea4efd386c1a6df913d0e6e8</SHA-1>
              <MD5>e303881ba58db7f1af03e8ca8155cd86</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>cbdfc58bbfa167f4dab31d6a293a8cb33e2a56cbb5b23e3ccbc3cbfe0d57fdb5</SHA-256>
              <SHA-1>0a0e267dff120ddfb6b0ee9157cf9d1d4a38bfd1</SHA-1>
              <MD5>e86fc596ab52f2d60decc0f4ceb550d6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>cd485ec823938a31516075cfa2a8a4421c9bd0aa84c2d57ae0bc2c2db8d11793</SHA-256>
              <SHA-1>462d86b6b16e37c4af093102645f988d5afe3ec3</SHA-1>
              <MD5>a8688ebd8c89164de2b586973470b6b3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>d887d20dcf48fcc6b9c4abd73b7cec67a52fca97689c765ef97b47c7fc9ade3c</SHA-256>
              <SHA-1>9dde87857f973f7eecfb613d41983ec23a4065c5</SHA-1>
              <MD5>a967d7ca0fed779cdb4f6b6218aa11d3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>e5a073448c3eaa32032772919b48457da092b49d673ff5c1069424e211b37568</SHA-256>
              <SHA-1>54cda9e445052f5721b3b555236fba3cdaebb957</SHA-1>
              <MD5>0e5b491fcd3b153f07dc83c03b591f6d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>ef90526e98cdaf902fc17ed39ca2f377d86c1cf3029ac1c9203bf50a3287c73e</SHA-256>
              <SHA-1>0ad0d95365e5c3221ece7fbb05be134d7fbb72ad</SHA-1>
              <MD5>1973e03b4bb10cf483ba13b49258d503</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>f6babbceef41f71532c6c3ac471033d4e2a97ec07e64ae50a3ba862743baad3f</SHA-256>
              <SHA-1>b27645b08582a7019f03bdf8c98845c20d296105</SHA-1>
              <MD5>dfed3802b1354789bf05c21d8ddc9843</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
          </files>
        </iocs>
        <name>OutlastLauncher.exe</name>
        <report_id>a493a72b-59dd-4c07-8eab-0f14218c6073</report_id>
        <tags>
          <value>peexe</value>
          <value>anti-vm</value>
          <value>microsoft_visual_cc</value>
          <value>anti-debug</value>
          <value>evasive</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>2ca4e54cf0b98744ced6fbc240c8d98dfc3bdae0fcf0b7674e522d6b633fd2d7</id>
    <title>Analysis Report for 2ca4e54cf0b98744ced6fbc240c8d98dfc3bdae0fcf0b7674e522d6b633fd2d7</title>
    <updated>2026-10-05T11:41:04Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38d0ed130e7ad45267534</_id>
        <file_type>application/json</file_type>
        <flow_id>6ac38c7c4c2119a4a085682c</flow_id>
        <hash>2ca4e54cf0b98744ced6fbc240c8d98dfc3bdae0fcf0b7674e522d6b633fd2d7</hash>
        <iocs/>
        <name>addon.json</name>
        <report_id>e5b8e468-9159-4b57-9811-e3a2ae352cc0</report_id>
        <tags>
          <value>json</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d60263657242c4a7dd5a1de741e4fbb9b951189d39bf7b85a777f7e499cbe0d0</id>
    <title>Analysis Report for d60263657242c4a7dd5a1de741e4fbb9b951189d39bf7b85a777f7e499cbe0d0</title>
    <updated>2026-10-05T11:41:04Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38d1ad130e7ad4526753d</_id>
        <file_type>application/octet-stream</file_type>
        <flow_id>6ac38c7c4c2119a4a085682c</flow_id>
        <hash>d60263657242c4a7dd5a1de741e4fbb9b951189d39bf7b85a777f7e499cbe0d0</hash>
        <iocs/>
        <name>carpetfloor004a.vtf</name>
        <report_id>dcad067a-8d44-41dc-8ae2-e80b4d4b3095</report_id>
        <tags>
          <value>data</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>3f6fc8736d75158e017f33531c9b3923ae233bc08077c807c497de30d1081a88</id>
    <title>Analysis Report for 3f6fc8736d75158e017f33531c9b3923ae233bc08077c807c497de30d1081a88</title>
    <updated>2026-10-05T11:41:04Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38d15d130e7ad45267537</_id>
        <file_type>application/json</file_type>
        <flow_id>6ac38c7c4c2119a4a085682c</flow_id>
        <hash>3f6fc8736d75158e017f33531c9b3923ae233bc08077c807c497de30d1081a88</hash>
        <iocs/>
        <name>addon.json</name>
        <report_id>c6690306-ae78-4bae-b0ca-5aa77d6d1150</report_id>
        <tags>
          <value>json</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>c6275a31a882ac4991b97965da5f3c86e76e84f42b90c49221c8c00caec03c5e</id>
    <title>Analysis Report for c6275a31a882ac4991b97965da5f3c86e76e84f42b90c49221c8c00caec03c5e</title>
    <updated>2026-10-05T11:41:04Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38d18d130e7ad45267539</_id>
        <file_type>application/octet-stream</file_type>
        <flow_id>6ac38c7c4c2119a4a085682c</flow_id>
        <hash>c6275a31a882ac4991b97965da5f3c86e76e84f42b90c49221c8c00caec03c5e</hash>
        <iocs/>
        <name>billboard.vtf</name>
        <report_id>4d69566a-b1b0-4539-bec4-aebf28cde000</report_id>
        <tags>
          <value>data</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ac5ee15b9a385a22dbaa2cfa1951988cf0a17a62770b97cac1b5b428c5e9ef8a</id>
    <title>Analysis Report for ac5ee15b9a385a22dbaa2cfa1951988cf0a17a62770b97cac1b5b428c5e9ef8a</title>
    <updated>2026-10-05T11:41:04Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38d2fd130e7ad45267544</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac38c7c4c2119a4a085682c</flow_id>
        <hash>ac5ee15b9a385a22dbaa2cfa1951988cf0a17a62770b97cac1b5b428c5e9ef8a</hash>
        <iocs/>
        <name>billboard.vmt</name>
        <report_id>9c1f5f94-0514-4141-a6c9-fdde8a182d0c</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>71dceb14788b843e5a071fb669dbe8a5a1c3a0c882f81e151f249487b32fb8b9</id>
    <title>Analysis Report for 71dceb14788b843e5a071fb669dbe8a5a1c3a0c882f81e151f249487b32fb8b9</title>
    <updated>2026-10-05T11:39:39Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38c87d130e7ad4526750d</_id>
        <file_type>application/vnd.android.package-archive</file_type>
        <flow_id>6ac38c78dedbc9646d41bd43</flow_id>
        <hash>71dceb14788b843e5a071fb669dbe8a5a1c3a0c882f81e151f249487b32fb8b9</hash>
        <iocs>
          <urls>
            <value>
              <url>https://api.example.com/version</url>
              <origin>APK_DECODING</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>api.example.com</url>
              <origin>APK_DECODING</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
        </iocs>
        <name>WEDDING INVITATION CARD ♥️💫.apk</name>
        <report_id>fe157981-7e02-4c3e-b0e6-c81feeac48e5</report_id>
        <tags>
          <value>apk</value>
          <value>signed</value>
          <value>base64</value>
          <value>evasive</value>
          <value>fingerprint</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>b8ea5d5b4cdd260b3c48e3a933535af819b4b018dcec1698355693e50acb378b</id>
    <title>Analysis Report for b8ea5d5b4cdd260b3c48e3a933535af819b4b018dcec1698355693e50acb378b</title>
    <updated>2026-10-05T11:38:06Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38c3dd130e7ad452674f9</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6ac38c1b7e4998b7d617ed09</flow_id>
        <hash>b8ea5d5b4cdd260b3c48e3a933535af819b4b018dcec1698355693e50acb378b</hash>
        <iocs>
          <urls>
            <value>
              <url>http://ns.adobe.com/exif/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/photoshop/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/tiff/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/mm</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/sType/ResourceEvent</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/sType/ResourceRef</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/elements/1.1</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.facebook.com/unfilteredaudio</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.instagram.com/unfilteredaudio</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.twitter.com/unfilteredaudio</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.unfilteredaudio.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://juce.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.plugin-alliance.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.plugin-alliance.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.plugin-alliance.com/buy/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://www.plugin-alliance.com/downloads/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.plugin-alliance.com/en/support.html</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.plugin-alliance.com/forgotpassword</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.plugin-alliance.com/plugins/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://www.plugin-alliance.com/register</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>facebook.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>instagram.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>juce.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>ns.adobe.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>plugin-alliance.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>purl.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>twitter.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>unfilteredaudio.com</url>
              <origin>INPUT_FILE</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>contact@unfilteredaudio.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>57.144.244.1</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>57.144.214.34</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>207.241.225.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>2.16.245.170</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.66.0.227</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>35.214.85.231</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.227.38.32</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>1a9df833ba832f693cf9724619cd5d9121b0699215b0fa258a28f845d3a5874d</SHA-256>
              <SHA-1>9488f223079b4f7871883fac1055b085a9777830</SHA-1>
              <MD5>482a0b21b0c8330ef4c201facb1c3f78</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>3a301d99bdb6f301b9645248dfe56e72e4e05b3c22453b2f87358d2990d9a99d</SHA-256>
              <SHA-1>1abe583acf6f94dde7e0692852e39b1db00e4cd0</SHA-1>
              <MD5>f5a968f59b57e85eed23a1aa9fc6f530</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>3bd4d40ea17f1705e98eeba2ca02dbb6ee543a9200bb6847c4834ec66c632b5d</SHA-256>
              <SHA-1>1d154e8fb4b2859b14935bcd500099b8870b219c</SHA-1>
              <MD5>38a0a6daee63a18d82ec43dea1395815</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>76f2c7acba89ff5bf91b4d9c0d8e42e337b079033bf77e4beffbe9758d2cea28</SHA-256>
              <SHA-1>632e2aa522bc1bfa8be2d32a1260b1bb50c93098</SHA-1>
              <MD5>ce50682981c11c432328567a7fffff84</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>84991d34e717ae7f74c1b9ff5192e7d50a2ef4799df6c9f6575affcf1d033823</SHA-256>
              <SHA-1>e4c5e6b5b85d793eb4456c365e74bb783314e32b</SHA-1>
              <MD5>f8d87ca2f18b572071ecd6999718ff26</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>088a885f27ea5b17d0dc3b658915b2f28c5be1e2f13ce66154682ae21fc93ab6</SHA-256>
              <SHA-1>22b73033a3106465b58a3fbd9b2aca6089b2d05e</SHA-1>
              <MD5>a9fc35c97d887cdd1a31dd75c06602fd</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>18642ac66f924e2d92fcd9f34dd7f068a5d2489f9052c4d240b182dac4524f01</SHA-256>
              <SHA-1>ec0b5ca87a0f5324710b587bff6e9d9ab2c4b5d2</SHA-1>
              <MD5>90ddc2e2e5e07220b44cad6dd774b59b</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>fb32e12fa9bee1379acc0cf921ba7e79a6b85bd46253d993db0898847b9870a1</SHA-256>
              <SHA-1>5afcdba7bf49ea157775201417cf4ade57f0e4b2</SHA-1>
              <MD5>395be4539ecc2498cec2fdae80e8600e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>08fa5a99-b1f1-11e9-a6d9-eb963a40cf17</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4fc3d972-4d77-412b-8efc-5fc61e0e9178</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>7f0fb7e2-daee-4f0a-9e47-cdc10644f141</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8c391d4d-0165-6546-9f4b-dc926a58ce2c</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>9332085a-3945-c94f-924f-c7c2856447f5</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>af96d625-2152-e141-8e85-7467946b8888</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>cab10043-7535-2f45-bf69-b28ff2e8f7cd</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>cd2019a7-0f0b-c842-957a-01e18ac7f175</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e4f17013-8801-c64c-ac53-772208ac43ed</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>f0dfde39-afa2-11e9-89c3-c5b87f1e740e</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>fe1b02f0-92f2-d543-9f16-0b137e9d5111</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>HKCU\Software\Classes\</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SYSTEM\CurrentControlSet\Services\Disk\Enum</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Plugin Alliance\Common\PluginInfo</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>Unfiltered Audio SpecOps.dll</name>
        <report_id>df8b58d3-0a3e-4f54-9e59-1df099c48a75</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>html</value>
          <value>keylogger</value>
          <value>anti-vm</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>evasive</value>
          <value>packed</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>base64</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e000b6ed57da48da099dff02a9fbef8eea9fd0c4ed0abdf6f7dc2ce2826cf9ae</id>
    <title>Analysis Report for e000b6ed57da48da099dff02a9fbef8eea9fd0c4ed0abdf6f7dc2ce2826cf9ae</title>
    <updated>2026-10-05T11:37:50Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38c15d130e7ad452674ed</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac38c0ededbc9646d41bc49</flow_id>
        <hash>e000b6ed57da48da099dff02a9fbef8eea9fd0c4ed0abdf6f7dc2ce2826cf9ae</hash>
        <iocs/>
        <name>9968700_3ac82299-292e-4db2-8986-08a6524156dd@9968700</name>
        <report_id>9c747769-9050-497d-9979-59d0f846daff</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0cf295ddfcd8356d7b38f79430ad9821eb40141523c3e3dfd0e9781b05ab8798</id>
    <title>Analysis Report for 0cf295ddfcd8356d7b38f79430ad9821eb40141523c3e3dfd0e9781b05ab8798</title>
    <updated>2026-10-05T11:36:35Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38bd9d130e7ad452674dc</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6ac38bc2dedbc9646d41bb7a</flow_id>
        <hash>0cf295ddfcd8356d7b38f79430ad9821eb40141523c3e3dfd0e9781b05ab8798</hash>
        <iocs>
          <urls>
            <value>
              <url>https://kitgkat.com/KH7Nf0Os</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2000/svg</url>
              <origin>EMAIL_BODY</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://kitgkat.com/KH7Nf0Os</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>file:///tmp/tmpwb2x_lnp.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://kitgkat.com/KH7Nf0Os</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>kitgkat.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>kitgkat.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>kitgkat.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>w3.org</url>
              <origin>EMAIL_BODY</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>188.114.96.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.23.19</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>217.60.76.242</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>61edb8e12ff8999d0bf8d6cb0c0d76176ef9e3aff533a0c8b36fd47e4cdb6248</SHA-256>
              <SHA-1>d839392131c60b4b1168f60e3a06a8f2cf04aaa4</SHA-1>
              <MD5>efaa450c836a31c41356dd96c712375f</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/html</file_type>
            </value>
            <value>
              <SHA-256>820cf5257178fc9022d3bda497fa944efa2893ca1223b5ea6f78f247c20c6c87</SHA-256>
              <SHA-1>b3d1d65fc50b2b877825e5203f2bafed7db4ad9c</SHA-1>
              <MD5>7ddc9d707acf5edb2e23b88121b0ffbf</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>cddbbd650cc2447f82f66b90349a421eada556b9c23d052dcfdf4aae89b293ca</SHA-256>
              <SHA-1>8a301d8f6fd4a5d6877443a8a39ac952c099c435</SHA-1>
              <MD5>5fcbac325cb555e565b10988639d49bc</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>submission.eml</name>
        <report_id>d48b060b-7888-4430-87eb-3e2fca083601</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
          <value>html</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>366ae0f1929662a3a8b05925e1bf836bbfd4b27c16661b88323f28ddabbd2cc2</id>
    <title>Analysis Report for 366ae0f1929662a3a8b05925e1bf836bbfd4b27c16661b88323f28ddabbd2cc2</title>
    <updated>2026-10-05T11:33:10Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38b07d130e7ad452674a4</_id>
        <file_type>application/pdf</file_type>
        <flow_id>6ac38af4dedbc9646d41b97b</flow_id>
        <hash>366ae0f1929662a3a8b05925e1bf836bbfd4b27c16661b88323f28ddabbd2cc2</hash>
        <iocs>
          <urls>
            <value>
              <url>https://urlifequality.com/B7pR3xM9kT5vQ2nLd-HF8yW4cJ6sA1zE-Nm3K9qVxP7rL5bU-D2tY8gCT4nZ8qH2vM6xK9pRs-JC5wF7yL3dA1uE-Qb8V2kNxR4mP6gW-D9sT5cYM9xC4vQ7pL2nR6kTz-GW3dY8hF5sJ1aE-Vq7N4mKxP9rB2uL-D6tZ8cH</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://urlifequality.com/Q7mK4xL9vP2nR8aTz-WE3cY6hJ1uD5sF-Gp9V7kLmN2xQ8bA-C4rT6wZ</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://urlifequality.com/B7pR3xM9kT5vQ2nLd-HF8yW4cJ6sA1zE-Nm3K9qVxP7rL5bU-D2tY8gCT4nZ8qH2vM6xK9pRs-JC5wF7yL3dA1uE-Qb8V2kNxR4mP6gW-D9sT5cYM9xC4vQ7pL2nR6kTz-GW3dY8hF5sJ1aE-Vq7N4mKxP9rB2uL-D6tZ8cH</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>urlifequality.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>urlifequality.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>davide.aluisio@teleimpianti.it</email>
              <origin>CONTENT_PARSE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>82.221.136.52</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>4932bc2a932aa4a290f59c4b2ecc8790fd87766652105784b9b5e487497c7e79</SHA-256>
              <SHA-1>88b5892edc075db43b17645eb5ab1bf92669337a</SHA-1>
              <MD5>969ef0c4ded571ffc8956701dfeda453</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>9864f27f7c7b33a7e16b6d0e6aebcbf8b2479b202f69535664bcfda965283fa6</SHA-256>
              <SHA-1>273780e2f2d4465807de696849573a274cb0deea</SHA-1>
              <MD5>107efcf19d44bcac222ffe6015a87ed4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
          </files>
        </iocs>
        <name>Teleimpianti S.p.A 20220040073.pdf</name>
        <report_id>252f5556-41b7-4271-a0e8-318cb4bc460c</report_id>
        <tags>
          <value>pdf</value>
          <value>form</value>
        </tags>
        <verdict>UNKNOWN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a662130f7974969ca7b04fd0dd88bf3a9d599f07408fa6fe0862cffa0dba7f1b</id>
    <title>Analysis Report for a662130f7974969ca7b04fd0dd88bf3a9d599f07408fa6fe0862cffa0dba7f1b</title>
    <updated>2026-10-05T11:32:18Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38aeed130e7ad4526749d</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac38ac036412e623d2c9185</flow_id>
        <hash>a662130f7974969ca7b04fd0dd88bf3a9d599f07408fa6fe0862cffa0dba7f1b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://kivinen.wordpress.com/2026/09/02/task-cards-for-teaching-ai-literacy-ai-competence-descriptions-for-learners/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/2026/09/02/task-cards-for-teaching-ai-literacy-ai-competence-descriptions-for-learners/&amp;for=wpcom-auto-discovery</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/2026/09/02/task-cards-for-teaching-ai-literacy-ai-competence-descriptions-for-learners/&amp;signup_flow=account</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://0.gravatar.com/avatar/?s=96%5Cu0026amp;d=identicon%5Cu0026amp;r=G</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ailiteracyframework.org/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://faktabaari.fi/edu/paivitetyt-tekoalyosaamisen-kuvaukset-mukana-koko-koulutuspolku-varhaiskasvatuksesta-korkea-asteelle/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://faktabaari.fi/images/ai_competence_descriptions-en.pdf</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://faktabaari.fi/images/ai_task_bank_by_level_en.pdf</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/WordPress/WordPress/blob/a59eb9d39c4fcba834b70c9e8dfd64feeec10ba6/wp-includes/class-wp-scripts.php#L428.</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://gmpg.org/xfn/11</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/2025/03/03/how-generative-ai-works-education-approach/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/2025/11/17/the-finnish-approach-to-media-and-information-literacy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/2026/09/02/task-cards-for-teaching-ai-literacy-ai-competence-descriptions-for-learners/?share=facebook</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/2026/09/02/task-cards-for-teaching-ai-literacy-ai-competence-descriptions-for-learners/?share=twitter</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/2026/09/02/task-cards-for-teaching-ai-literacy-ai-competence-descriptions-for-learners/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/?openidserver=1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/about/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/author/kivinen/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/category/digital-information-literacy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/category/education/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/category/genai/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/comments/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/osd.xml</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/tag/ai-competences/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/tag/ai-literacy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/tag/ai/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/tag/artificial-intelligence/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/tag/digcomp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/tag/digital-competences/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/tag/education/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/tag/faktabaari/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/tag/finnish-education/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/wp-comments-post.php</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/wp-content/uploads/2026/09/descriptions-early-education.jpg</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/wp-content/uploads/2026/09/descriptions-secondary-education.jpg</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/wp-content/uploads/2026/09/task-card-image.jpg</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/xmlrpc.php</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/xmlrpc.php?rsd</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://public-api.wordpress.com/oembed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://public-api.wordpress.com/oembed/?format=json&amp;url=https%3A%2F%2Fkivinen.wordpress.com%2F2026%2F09%2F02%2Ftask-cards-for-teaching-ai-literacy-ai-competence-descriptions-for-learners%2F&amp;for=wpcom-auto-discovery</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://public-api.wordpress.com/oembed/?format=xml&amp;url=https%3A%2F%2Fkivinen.wordpress.com%2F2026%2F09%2F02%2Ftask-cards-for-teaching-ai-literacy-ai-competence-descriptions-for-learners%2F&amp;for=wpcom-auto-discovery</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://publications.jrc.ec.europa.eu/repository/handle/JRC144121</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s0.wp.com/wp-content/js/wpcom-proxy-request.js?m=1513050504i&amp;amp;ver=20211021</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://s0.wp.com/wp-content/mu-plugins/wpcom-smileys/twemoji/2/72x72/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://s0.wp.com/wp-content/mu-plugins/wpcom-smileys/twemoji/2/svg/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://s1.wp.com/i/favicon.ico?m=1713425267i</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s1.wp.com/opensearch.xml</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s1.wp.com/wp-content/mu-plugins/jetpack-mu-wpcom-plugin/moon/jetpack_vendor/automattic/jetpack-mu-wpcom/src/build/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://s2.wp.com/i/webclip.png?m=1713868326i</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s2.wp.com/wp-content/plugins/coblocks/2.18.1-simple-rev.4/dist/js/coblocks-lightbox.min.js?m=1681832297i</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://s2.wp.com/wp-content/plugins/coblocks/2.18.1-simple-rev.4/dist/js/coblocks-masonry.min.js?m=1681832297i</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://subscribe.wordpress.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://subscribe.wordpress.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://widgets.wp.com/likes/master.html?ver=20261004#ver=20261004</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://widgets.wp.com/verbum-block-editor/block-editor.css?ver=1771405207</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://wordpress.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://wordpress.com/?ref=footer_blog</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://wordpress.com/abuse/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://wordpress.com/abuse/?report_url=https://kivinen.wordpress.com/2026/09/02/task-cards-for-teaching-ai-literacy-ai-competence-descriptions-for-learners/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://wordpress.com/log-in</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://wordpress.com/log-in?redirect_to=https%3A%2F%2Fkivinen.wordpress.com%2F2026%2F09%2F02%2Ftask-cards-for-teaching-ai-literacy-ai-competence-descriptions-for-learners%2F&amp;signup_flow=account</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://wordpress.com/reader/blogs/34649166/posts/1282</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://wordpress.com/start/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://wordpress.com/start?ref=wplogin</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://wp.me/p2lnPw-kG</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://bitly.com/?utm_source=Bitly&amp;utm_medium=referral&amp;utm_campaign=preview_page</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://adaptmx.com/privacy-policy/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bd.lngtd.com/id.txt</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bit.ly/4dLhcF4</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bit.ly/preview_page/beacon</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bitly.com/pages/privacy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bitly.fides-cdn.ethyca.com/api/v1/notices-served</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bitly.fides-cdn.ethyca.com/api/v1/privacy-experience?show_disabled=false&amp;region=de_he&amp;component=overlay&amp;has_config=true&amp;systems_applicable=true&amp;exclude_gvl_languages=true&amp;include_meta=true&amp;include_gvl=true&amp;include_non_applicable_notices=true&amp;property_id=FDS-I3S3I5</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bitly.fides-cdn.ethyca.com/fides.js?&amp;property_id=FDS-I3S3I5</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://corp.aarki.com/privacy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d1ayxb9ooonjts.cloudfront.net/d/12032AF2C457BB634C4039A306C2C39420BF51EB.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d1ayxb9ooonjts.cloudfront.net/d/704DBB97AC75F2A7D9571254B944F17277707059.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d1ayxb9ooonjts.cloudfront.net/d/7C75D35E20E45DF9C90AF96EB32B81BAAA55B50D.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d1ayxb9ooonjts.cloudfront.net/d/8955792E2AE2972C05969B26C881AD988C9BB5BD.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d1ayxb9ooonjts.cloudfront.net/d/8F9B499DDC670821F87C474721CA954C0C1AD3F5.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d1ayxb9ooonjts.cloudfront.net/d/911DC5232AD960E5CD922312AAAA1768D921C30F.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d1ayxb9ooonjts.cloudfront.net/d/C1479C1BB4EBAEE77A9F4B616943FFEE9DAAEA0E.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d1ayxb9ooonjts.cloudfront.net/d/E8AA887989AD48F5366B7DCFAEAB4A3FF8150A1D.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d1ayxb9ooonjts.cloudfront.net/d/F91CE64489DC8F93951CBC1B287E2C712CA507BB.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://escalax.io/legal/privacy-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://floors.lngtd.com/?account=bitly&amp;section=default</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://kivinen.wordpress.com/2026/09/02/task-cards-for-teaching-ai-literacy-ai-competence-descriptions-for-learners/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://legal.clickio.com/PrivacyPolicyAdvertising/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://lngtd.com/bitly.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://lngtd.com/bitly/default.1787154287.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://marketing.8pod.com/privacy-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mkt-static.bitly.com/static/1758312561/pages/wp-content/uploads/2021/08/bitly_logo.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://securepubads.g.doubleclick.net/pagead/managed/dict/m202610010101/gpt</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202609300101/pubads_impl.js?cb=122881362</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://securepubads.g.doubleclick.net/tag/js/gpt.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://virtualminds.com/platform-privacy-policy/</url>
              <origin>URL_RENDER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>https://www.adfixus.com/platform-privacy-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.adlayer.se/cloudprivacy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.adlayer.se/legitimate-interest</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.adtango.com/privacy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.ethyca.com/janus?utm_source=fides_consent&amp;utm_medium=referral&amp;utm_campaign=cmp_backlinks&amp;utm_term=janus</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/bitly</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/bitly/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/bitly/mycompany/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.minutemedia.com/policies/privacy-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://x.com/bitly</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bit.ly/4dLhcF4</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>0.gravatar.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ailiteracyframework.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>faktabaari.fi</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>gmpg.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>kivinen.wordpress.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>public-api.wordpress.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>publications.jrc.ec.europa.eu</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s0.wp.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s1.wp.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s2.wp.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>subscribe.wordpress.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>widgets.wp.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>wordpress.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>wp.me</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>adaptmx.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>bd.lngtd.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>bit.ly</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>bitly.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>bitly.fides-cdn.ethyca.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>corp.aarki.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>d1ayxb9ooonjts.cloudfront.net</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>escalax.io</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>floors.lngtd.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>kivinen.wordpress.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>legal.clickio.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>lngtd.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>marketing.8pod.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mkt-static.bitly.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>securepubads.g.doubleclick.net</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>virtualminds.com</url>
              <origin>URL_RENDER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>www.adfixus.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.adlayer.se</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.adtango.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.ethyca.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>www.instagram.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.minutemedia.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>x.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>192.0.78.22</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>139.191.221.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>192.0.78.13</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>192.0.77.32</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>108.138.26.89</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.33.158.128</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.154</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>3.174.46.67</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>34.54.65.222</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>65.9.130.22</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>65.9.130.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>67.199.248.10</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.21.51.206</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>192.0.78.12</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>140.82.121.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>66.155.40.24</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>192.0.78.17</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>164.92.248.81</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>192.0.73.2</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>192.0.78.25</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>7f1f1c3e964bfd63fec353144ca822f44bc55328541f848fa23f4dc61222d662</SHA-256>
              <SHA-1>aba0d3fb4654f2f9d41a6c9c40bb3effb304483c</SHA-1>
              <MD5>5911f5b378885e3fb309150d1f943de4</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/jpeg</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>cd6a0e443065c9a324303bb69bb0578a384343e9250029635a208e2f98dd2d1c</SHA-256>
              <SHA-1>fbabeaa9968ffa91a93501b4ad71c828d54d0e67</SHA-1>
              <MD5>b580595e3eed3de785590ea93bb453d7</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>cc5ff6e40496f5709a92b2c9cae269288956b06c348f49c1a140023dd04543c0</SHA-256>
              <SHA-1>d1087d463392e9ea4b9d4e5dab49a3c46cbeaad2</SHA-1>
              <MD5>2eb1d93cceddde11b8e2dcc06e42eb97</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>b24b883372e2309f869efc969448bf56d294fd817685a7053696855d36f0bd42</SHA-256>
              <SHA-1>758e05e143d4c6339690f72525c99d93fb7f1e71</SHA-1>
              <MD5>45d1fbd7d35f51542e9b2c24c5d606fe</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>d7e08460caf66b26feb6e513b4bb59fd0acc1bc02b14115758ae1067e210f194</SHA-256>
              <SHA-1>571d23b21fd0c406d78028c39b377477330f85e5</SHA-1>
              <MD5>c19dca2ea4714520049bf38e235692a9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>cd9661992d51e0b85fbcaaf5c9691c8490c4116de20626cbd4522b2a57900009</SHA-256>
              <SHA-1>a0ff5462991df0560238a019b5de76f620387012</SHA-1>
              <MD5>02e143780b224fc5248dea38ac6d8f80</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>e2148b5c840294bba47314111f56a958963a5dd0b188071ec2d52cbca581be49</SHA-256>
              <SHA-1>159020bf3263a65942010540c9139c01f0360e3b</SHA-1>
              <MD5>8a2608ab0d033d254eb11b80b59860b2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>78fc670bbdf309f1645a624cb4e22af037e52d0678c53e992f6d1fde820e6920</SHA-256>
              <SHA-1>04e17f24d2e540e37508153a7523a143b8141de1</SHA-1>
              <MD5>c5749efce7b17607aa24a76bb4276d17</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://bit.ly/4dLhcF4</name>
        <report_id>3a282122-9bc6-4e49-9ec1-10850fa13155</report_id>
        <tags>
          <value>html</value>
          <value>javascript</value>
          <value>xml</value>
          <value>jpg</value>
          <value>base64</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>5ca377edcd6dd81e73004b60fdf90c984a54a4be75cfbcfd39b8fab4ef52c192</id>
    <title>Analysis Report for 5ca377edcd6dd81e73004b60fdf90c984a54a4be75cfbcfd39b8fab4ef52c192</title>
    <updated>2026-10-05T11:32:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38ad3d130e7ad45267497</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac38abf36412e623d2c916c</flow_id>
        <hash>5ca377edcd6dd81e73004b60fdf90c984a54a4be75cfbcfd39b8fab4ef52c192</hash>
        <iocs>
          <urls>
            <value>
              <url>http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl.usertrust.com/AddTrustExternalCARoot.crl05</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl.usertrust.com/UTN-USERFirst-Object.crl0t</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crt.comodoca.com/COMODORSAAddTrustCA.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crt.comodoca.com/COMODORSACodeSigningCA.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0#</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crt.usertrust.com/UTNAddTrustObject_CA.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/SMI/2005/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://sectigo.com/CPS0B</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://secure.comodo.net/CPS0C</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>crl.comodoca.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crl.sectigo.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crl.usertrust.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crt.comodoca.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crt.sectigo.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crt.usertrust.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>sectigo.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>secure.comodo.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>contact@esotericsoftware.com0</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>104.18.38.233</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.64.149.23</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>3.8.75.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>91.199.212.90</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>0cf9e62409a5d1f5f523d60e447f77395c0c32e2e1e506bb7bb782e3b5d02f6d</SHA-256>
              <SHA-1>81a6f97fb3539975da2254bcd8e22507c4b59607</SHA-1>
              <MD5>888b94a13569566165821776584f3fac</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>103e3ef9005b74d537ed5cedffc41bd6b2d07cd526e44cb0b949138c2089ef61</SHA-256>
              <SHA-1>b186a14f26c65b4a42eba52c82ec8640d2267a61</SHA-1>
              <MD5>ef330c9c26e45547c97013177fcb42e6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>30eac4d9c8a0e7a34bd5ec6cea4683fe48bd40e85c9e3ac35e0a9d21c896c226</SHA-256>
              <SHA-1>4ea541ed829b88908b94a6db2b8d635f72066707</SHA-1>
              <MD5>57a794c299d5e1bee66ae62a8e91601e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>43a5a814ea7323ece7153607f130a271fdcbfa01bb080d74a0832256abb5376d</SHA-256>
              <SHA-1>5de8e1eab84203bf5d721be542c9c1818af70b25</SHA-1>
              <MD5>b3068dc37dfdb41cd38d269e7a162bda</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>48b47084e8c98fae68919153b83777986ab18423a7ddf84c4174fa8bfac50e07</SHA-256>
              <SHA-1>325ba09d90ee811bf3ad5db9f8af9ec54feaaaf8</SHA-1>
              <MD5>42905ce744c8550d7c098b5fe6ba55a0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>7a0f07b91be3d21cc76a4548a7c8cf37e29b21f16fc20a811e2508f1ccf92a59</SHA-256>
              <SHA-1>5dc0e752438a2dae464146d571acc653f39a6ab3</SHA-1>
              <MD5>41bcd8354551000d6b4fb86bb86fd114</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>85ef389004a04fcae6760aee4380881867fb154aac8c4033c8972beb82e52571</SHA-256>
              <SHA-1>277909d98e7ebf83e829eb28ba0d74433e05c89c</SHA-1>
              <MD5>5bcdf412503550aa44e9513c1aad1a79</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>99b1d583876d7ce01849a0d10c1186b004d2091b8537bea274d8743c12dee2a4</SHA-256>
              <SHA-1>6a2d13d82f3d1793fc2d1e28e4e2895a33dbfa44</SHA-1>
              <MD5>17c7491cef9e870dccca8b3f237ea063</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>c70e940c0d88b3c225f5fec0f0a4ecc8abf97a623f6cbdfd16817f76ee1aa1c5</SHA-256>
              <SHA-1>9094ca5ad8a901b92f7be55273672bad36d8e5c3</SHA-1>
              <MD5>c138314acad2f31dbedc744e2aeae527</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>d58d7d4bbc58f023d4bb203dd967e15f6681460612b02ad935e7ff3979dc6102</SHA-256>
              <SHA-1>461e0c84813d6c2f9e33b08cb928a69d5f3e97cf</SHA-1>
              <MD5>6fa39a5f6db3ad3489ae7c80de34d0af</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>dcd3323005e80082e8dadee597eb62e7b6ad5671302e6dffcac42a912e01ab4b</SHA-256>
              <SHA-1>b4d4ab6cc31e7c9442bc9d8454fb755a8f223c66</SHA-1>
              <MD5>657e5224924bd63a23dcae52253ae86d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
          </files>
        </iocs>
        <name>Spine.exe</name>
        <report_id>07ee6d50-d2a5-4e20-95bb-56a6c8ad5f14</report_id>
        <tags>
          <value>peexe</value>
          <value>expired-cert</value>
          <value>fingerprint</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>anti-debug</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>1ff5174fcbf3abbff85eacc73e6e548b0d094d913a48c1369f60811d1e92eeef</id>
    <title>Analysis Report for 1ff5174fcbf3abbff85eacc73e6e548b0d094d913a48c1369f60811d1e92eeef</title>
    <updated>2026-10-05T11:31:18Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38ac1d130e7ad45267493</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6ac38a834c2119a4a085652f</flow_id>
        <hash>1ff5174fcbf3abbff85eacc73e6e548b0d094d913a48c1369f60811d1e92eeef</hash>
        <iocs/>
        <name>tailscaled</name>
        <report_id>920466d3-6a94-4ef1-9526-4481c33b545b</report_id>
        <tags>
          <value>elf</value>
          <value>golang</value>
        </tags>
        <verdict>UNKNOWN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>93c3558f592200133b377dd9f96eac9b278b9057f7ae6b8656b15f4fa05506d0</id>
    <title>Analysis Report for 93c3558f592200133b377dd9f96eac9b278b9057f7ae6b8656b15f4fa05506d0</title>
    <updated>2026-10-05T11:29:38Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38a77d130e7ad45267485</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6ac38a2136412e623d2c8e1a</flow_id>
        <hash>93c3558f592200133b377dd9f96eac9b278b9057f7ae6b8656b15f4fa05506d0</hash>
        <iocs/>
        <name>tailscale</name>
        <report_id>d9f39905-ec80-4a55-974c-1b2293fdd869</report_id>
        <tags>
          <value>elf</value>
          <value>golang</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>2ea72a4e649451a452fc7fe679c9fc273735e2e444e201424e8c6ece84e56253</id>
    <title>Analysis Report for 2ea72a4e649451a452fc7fe679c9fc273735e2e444e201424e8c6ece84e56253</title>
    <updated>2026-10-05T11:28:38Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38a42d130e7ad4526747a</_id>
        <file_type>text/x-shellscript</file_type>
        <flow_id>6ac389e636412e623d2c8d34</flow_id>
        <hash>2ea72a4e649451a452fc7fe679c9fc273735e2e444e201424e8c6ece84e56253</hash>
        <iocs/>
        <name>ovpn.sh</name>
        <report_id>3a0de596-2600-477d-939b-deebeec6eacb</report_id>
        <tags>
          <value>shell</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>72c4e0c1830b371971f1b06c49829b4f92548fbee1c2f6b9f32039938da258c1</id>
    <title>Analysis Report for 72c4e0c1830b371971f1b06c49829b4f92548fbee1c2f6b9f32039938da258c1</title>
    <updated>2026-10-05T11:28:05Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38a28d130e7ad45267475</_id>
        <file_type>text/x-shellscript</file_type>
        <flow_id>6ac389c2dedbc9646d41b53b</flow_id>
        <hash>72c4e0c1830b371971f1b06c49829b4f92548fbee1c2f6b9f32039938da258c1</hash>
        <iocs/>
        <name>vpn-core.sh</name>
        <report_id>24fb7b3a-d163-4665-a15b-31dc2e355a9d</report_id>
        <tags>
          <value>shell</value>
          <value>expand</value>
          <value>lolbin</value>
        </tags>
        <verdict>UNKNOWN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>878a44484c2a78e949959b7018e753637d5fbc6fd67b4bb216cce3a43e6f405d</id>
    <title>Analysis Report for 878a44484c2a78e949959b7018e753637d5fbc6fd67b4bb216cce3a43e6f405d</title>
    <updated>2026-10-05T11:27:16Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac389e5d130e7ad45267466</_id>
        <file_type>application/pdf</file_type>
        <flow_id>6ac38992dedbc9646d41b4b0</flow_id>
        <hash>878a44484c2a78e949959b7018e753637d5fbc6fd67b4bb216cce3a43e6f405d</hash>
        <iocs>
          <urls>
            <value>
              <url>https://enhancv.com/resume</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.enhancv.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/in/aleksej-gaja%C4%8Dki-87012534b</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://enhancv.com/resume</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/in/aleksej-gaja%C4%8Dki-87012534b</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>enhancv.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>linkedin.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>enhancv.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>elgrandealeksej@gmail.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>130.211.32.14</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>65.8.131.29</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.64.146.215</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>d004ad782518d4c197480dd7554fa2d796b1cbdda1725d19ae488d5bbc68cfbb</SHA-256>
              <SHA-1>e8ecd3e8eb7e3609122b537d60ad441322dfe7c0</SHA-1>
              <MD5>52f2a2a1435752bcd4c74b36e59549a8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>a2ff6c2613572bbb2f53a9c35f04889f117ce825423df162836ac2c61902dedb</SHA-256>
              <SHA-1>a700da757f14dce36204eff34e6c80d0e14d72ea</SHA-1>
              <MD5>4024b6c765bebefbe1e6b69ec6c55e23</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>05aa068049094ea737c09b5bb2f5c8f4a0376648fa444989511f91323be19817</SHA-256>
              <SHA-1>dcf017d440cd3322808582e97aeff7112a7c9b3f</SHA-1>
              <MD5>22d1e2e3079aaeddf47555caee576db7</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/svg+xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>644031a68bde879af85bcc9cb3e6fa1e9a6b0f61d49307581974b5dbc09d3de8</SHA-256>
              <SHA-1>9176c614fa5aca9af6ceba4996cc9128842803f7</SHA-1>
              <MD5>895d2a337cecd4bf36e6ff9a7e669a63</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>CV Able Seaman (AB) CTV Deckhand Gajacki Aleksej.pdf</name>
        <report_id>c04d9fb7-7316-437f-a365-c7981d909d34</report_id>
        <tags>
          <value>pdf</value>
          <value>html</value>
          <value>svg</value>
          <value>base64</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>dccbbcb1f19cf455e41c9f2551733ab92433d162bd7d17564390db21f76bff93</id>
    <title>Analysis Report for dccbbcb1f19cf455e41c9f2551733ab92433d162bd7d17564390db21f76bff93</title>
    <updated>2026-10-05T11:27:14Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac389d5d130e7ad45267462</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac3898e36412e623d2c8b6a</flow_id>
        <hash>dccbbcb1f19cf455e41c9f2551733ab92433d162bd7d17564390db21f76bff93</hash>
        <iocs/>
        <name>tailscaled.defaults</name>
        <report_id>7ab50678-6d90-47c4-9f0b-e8e112d1a2b7</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>29e8181238b676071a1de377560a29a879adb2566a57873bba5c93c27ba7cfed</id>
    <title>Analysis Report for 29e8181238b676071a1de377560a29a879adb2566a57873bba5c93c27ba7cfed</title>
    <updated>2026-10-05T11:27:14Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac389f1d130e7ad4526746a</_id>
        <file_type>text/x-ini</file_type>
        <flow_id>6ac3898e36412e623d2c8b6a</flow_id>
        <hash>29e8181238b676071a1de377560a29a879adb2566a57873bba5c93c27ba7cfed</hash>
        <iocs/>
        <name>tailscale-wait-online.service</name>
        <report_id>6e8709f7-28e9-410e-a034-b737ad94780b</report_id>
        <tags>
          <value>txt</value>
          <value>ini</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9a3de2878785c9157296840527ff1f2212fa4f800c343fe720975d994a5f8861</id>
    <title>Analysis Report for 9a3de2878785c9157296840527ff1f2212fa4f800c343fe720975d994a5f8861</title>
    <updated>2026-10-05T11:27:14Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac389f0d130e7ad45267468</_id>
        <file_type>text/x-ini</file_type>
        <flow_id>6ac3898e36412e623d2c8b6a</flow_id>
        <hash>9a3de2878785c9157296840527ff1f2212fa4f800c343fe720975d994a5f8861</hash>
        <iocs/>
        <name>tailscale-online.target</name>
        <report_id>56929fc4-13b8-4a2b-be65-1732eea68238</report_id>
        <tags>
          <value>txt</value>
          <value>ini</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>93c3558f592200133b377dd9f96eac9b278b9057f7ae6b8656b15f4fa05506d0</id>
    <title>Analysis Report for 93c3558f592200133b377dd9f96eac9b278b9057f7ae6b8656b15f4fa05506d0</title>
    <updated>2026-10-05T11:27:14Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38a26d130e7ad45267474</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6ac3898e36412e623d2c8b6a</flow_id>
        <hash>93c3558f592200133b377dd9f96eac9b278b9057f7ae6b8656b15f4fa05506d0</hash>
        <iocs/>
        <name>tailscale</name>
        <report_id>6a0088cd-3efc-4d3d-b0b9-168338f7f2fc</report_id>
        <tags>
          <value>elf</value>
          <value>golang</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9a3de2878785c9157296840527ff1f2212fa4f800c343fe720975d994a5f8861</id>
    <title>Analysis Report for 9a3de2878785c9157296840527ff1f2212fa4f800c343fe720975d994a5f8861</title>
    <updated>2026-10-05T11:27:14Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac389d389017dd18dc1bee7</_id>
        <file_type>text/x-ini</file_type>
        <flow_id>6ac38991ddbdd2f79346ad27</flow_id>
        <hash>9a3de2878785c9157296840527ff1f2212fa4f800c343fe720975d994a5f8861</hash>
        <iocs/>
        <name>tailscale-online.target</name>
        <report_id>4e393d26-c952-402d-a04b-68e1d345b976</report_id>
        <tags>
          <value>txt</value>
          <value>ini</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>29e8181238b676071a1de377560a29a879adb2566a57873bba5c93c27ba7cfed</id>
    <title>Analysis Report for 29e8181238b676071a1de377560a29a879adb2566a57873bba5c93c27ba7cfed</title>
    <updated>2026-10-05T11:27:14Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac389d589017dd18dc1bee9</_id>
        <file_type>text/x-ini</file_type>
        <flow_id>6ac38991ddbdd2f79346ad27</flow_id>
        <hash>29e8181238b676071a1de377560a29a879adb2566a57873bba5c93c27ba7cfed</hash>
        <iocs/>
        <name>tailscale-wait-online.service</name>
        <report_id>62b4d1af-814b-4d76-991f-fc2c2e3823b4</report_id>
        <tags>
          <value>txt</value>
          <value>ini</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>dccbbcb1f19cf455e41c9f2551733ab92433d162bd7d17564390db21f76bff93</id>
    <title>Analysis Report for dccbbcb1f19cf455e41c9f2551733ab92433d162bd7d17564390db21f76bff93</title>
    <updated>2026-10-05T11:27:14Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac389f889017dd18dc1bef3</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac38991ddbdd2f79346ad27</flow_id>
        <hash>dccbbcb1f19cf455e41c9f2551733ab92433d162bd7d17564390db21f76bff93</hash>
        <iocs/>
        <name>tailscaled.defaults</name>
        <report_id>f74d0ae3-e86c-4179-b2b9-1640b0a04b79</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>93c3558f592200133b377dd9f96eac9b278b9057f7ae6b8656b15f4fa05506d0</id>
    <title>Analysis Report for 93c3558f592200133b377dd9f96eac9b278b9057f7ae6b8656b15f4fa05506d0</title>
    <updated>2026-10-05T11:27:14Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38a1289017dd18dc1bef9</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6ac38991ddbdd2f79346ad27</flow_id>
        <hash>93c3558f592200133b377dd9f96eac9b278b9057f7ae6b8656b15f4fa05506d0</hash>
        <iocs/>
        <name>tailscale</name>
        <report_id>fe62c7c0-95b2-4b43-b619-d678fd722927</report_id>
        <tags>
          <value>elf</value>
          <value>golang</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>999a6755b04a3da1b9839728f4f390706e1f63bfe5302c400e66fda14d5e04ef</id>
    <title>Analysis Report for 999a6755b04a3da1b9839728f4f390706e1f63bfe5302c400e66fda14d5e04ef</title>
    <updated>2026-10-05T11:27:13Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3899dd130e7ad45267456</_id>
        <file_type>application/hta</file_type>
        <flow_id>6ac3898fdedbc9646d41b497</flow_id>
        <hash>999a6755b04a3da1b9839728f4f390706e1f63bfe5302c400e66fda14d5e04ef</hash>
        <iocs/>
        <name>Captcha.hta</name>
        <report_id>384e4d70-0f99-4bd0-82fb-6fbad81808bd</report_id>
        <tags>
          <value>hta</value>
          <value>obfuscated</value>
        </tags>
        <verdict>UNKNOWN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>864bcec7c1e69bd5a4a6f8613a4ac047e748a598e5a9948f28fba3f3e709d203</id>
    <title>Analysis Report for 864bcec7c1e69bd5a4a6f8613a4ac047e748a598e5a9948f28fba3f3e709d203</title>
    <updated>2026-10-05T11:27:01Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac389c8d130e7ad4526745e</_id>
        <file_type>application/vnd.android.package-archive</file_type>
        <flow_id>6ac38985dedbc9646d41b47b</flow_id>
        <hash>864bcec7c1e69bd5a4a6f8613a4ac047e748a598e5a9948f28fba3f3e709d203</hash>
        <iocs>
          <urls>
            <value>
              <url>http://2359media.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://actionbarsherlock.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://aidanfollestad.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://amlcurran.github.io/ShowcaseView/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://androidannotations.org/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://apache.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://baoyz.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://blog.wiresareobsolete.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://blog.zhanghai.me/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://bluelinelabs.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://chris.banes.me/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://commons.apache.org/proper/commons-csv/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://commons.apache.org/proper/commons-io/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://creativecommons.org/licenses/by/3.0/legalcode</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://daimajia.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://daimajia.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://danlew.net/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://developer.lge.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://developer.lge.com/MOBILE_HELP/index.jsp?topic=%2Flge.mobilesdk.LGQSlide.api%2Fhtml%2FDeveloping%2FDeveloping%2FDeveloping+with+LG+QSlide+SDK.htm</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://diogobernardino.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://emilsjolander.se</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://facebook.github.io/rebound/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://fasterxml.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://fsf.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://github.com/thiagokimo</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://github.com/umano/AndroidSlidingUpPanel</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://gmariotti.blogspot.it/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://google.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://greendao-orm.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://h6ah4i.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://hannesdorfmann.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://hannesdorfmann.com/mosby/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://inthecheesefactory.com/blog/correct-imageview-adjustviewbounds-with-adjustable-imageview/en</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://jakewharton.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://jakewharton.github.io/butterknife/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://javolution.org/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://jeffgilfelt.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://jhy.io/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://joanzapata.com/android-iconify/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://joda-time.sourceforge.net/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://jscience.org/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://jsoup.org/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://koush.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ksoichiro.blogspot.pt/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ksoichiro.github.io/Android-ObservableScrollView/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://libphonenumber.googlecode.com/svn/trunk/javascript/i18n/phonenumbers/demo-compiled.html</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://luke.klinker.xyz/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://malinskiy.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://mikepenz.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://mixpanel.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://mixpanel.github.io/mixpanel-android/index.html</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://nineoldandroids.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://nostra13android.blogspot.co.at/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://opensource.org/licenses/BSD-2-Clause</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://opensource.org/licenses/BSD-3-Clause</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://opensource.org/licenses/MIT</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://orhanobut.com/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://paymill.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://reactivex.io/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://relex.me/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://robolectric.org/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://roomorama.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://satyan.github.io/sugar/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://scripts.sil.org/OFL</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://site.mockito.org/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://square.github.io/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://square.github.io/dagger/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://square.github.io/okhttp/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://square.github.io/picasso/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://square.github.io/retrofit/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://stfalcon.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://su.chainfire.eu/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://svn.apache.org/viewvc/commons/proper/io/trunk</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://tozny.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://trello.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://umanoapp.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://viewpagerindicator.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://wasabeef.jp/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://wiki.fasterxml.com/JacksonHome</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://wiresareobsolete.com/wordpress/2012/12/textdrawable-draw-some-text/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://wittchen.biz.pl</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.activeandroid.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.akexorcist.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.apache.org/licenses/LICENSE-2.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.apache.org/licenses/LICENSE-2.0.html</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.avast.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.daniel-stone.uk/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.devbrackets.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.eduardereza.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.facebook.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.freepik.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.freepik.com/free-photos-vectors/people</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.gnu.org/licenses.</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.gnu.org/licenses/lgpl-3.0.en.html</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.gotev.net</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.javadude.nl/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.jetbrains.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.joanzapata.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.michaelpardo.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.michaelpardo.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.npgall.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.orfjackal.net/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.piwai.info/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.qos.ch</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.twitter.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.williammora.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://www.wix.com/amulyakhare/portfolio</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://about.me/hoanglamvn90</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://android.googlesource.com/platform/frameworks/support/+/master/v7/appcompat/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://apache.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://axelrindle.de</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://bitbucket.org/danielnadeau</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://bitbucket.org/danielnadeau/holographlibrary</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://cloudrail.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://code-troopers.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://code.google.com/p/google-gson/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://code.google.com/p/guava-libraries/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://commons.apache.org/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://commons.apache.org/proper/commons-compress/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://commons.apache.org/proper/commons-lang/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://creativecommons.org/licenses/by/4.0/legalcode</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://creativecommons.org/publicdomain/zero/1.0/legalcode</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://devbrackets.com/dev/libs/exomedia.html</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://developer.android.com/google/play-services/index.html</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://developer.android.com/reference/android/support/annotation/package-summary.html</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://developer.android.com/reference/android/support/constraint/package-summary.html</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://developer.android.com/reference/android/support/design/widget/package-summary.html</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://developer.android.com/reference/android/support/multidex/MultiDex.html</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://developer.android.com/reference/android/support/v7/widget/CardView.html</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://developer.android.com/reference/android/support/v7/widget/RecyclerView.html</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://developer.android.com/reference/android/widget/GridLayout.html</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://developer.android.com/tools/support-library/features.html#v4</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://developer.android.com/tools/support-library/features.html#v7</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://developer.android.com/topic/libraries/support-library/packages.html</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://developer.android.com/training/data-storage/manage-all-files</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://developer.android.com/training/data-storage/manage-all-files;target=_blank</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://developer.android.com/training/volley/index.html</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://developers.facebook.com/docs/android</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://flipboard.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/2359media/EasyAndroidAnimations</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/3breadt/dd-plist</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/ACRA/acra</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/AnderWeb/discreteSeekBar</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/ApmeM/android-flowlayout</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/ArthurHub/Android-Image-Cropper</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/Chainfire/libsuperuser</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/Clans</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/Clans/FloatingActionButton</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/CloudRail/cloudrail-si-android-sdk</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/DWorkS/VolleyPlus</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/DanielMartinus</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/DanielMartinus/Konfetti</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/DanielMartinus/Konfetti/blob/master/LICENSE</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/DmitryMalkovich</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/DmitryMalkovich/material-design-dimens</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/DreaminginCodeZH/CustomTabsHelper</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/DreaminginCodeZH/MaterialProgressBar</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/DreaminginCodeZH/MaterialRatingBar</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/Ereza/CustomActivityOnCrash</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/Flipboard/bottomsheet</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/Flipboard/bottomsheet/blob/master/LICENSE</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/JakeWharton/ActionBarSherlock</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/JakeWharton/Android-ViewPagerIndicator</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/JakeWharton/NineOldAndroids</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/JakeWharton/ProcessPhoenix</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/JakeWharton/RxBinding</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/JakeWharton/butterknife</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/JakeWharton/kotterknife</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/JakeWharton/timber</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/JoanZapata</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/JoanZapata/android-asyncservice</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/JoanZapata/android-iconify</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/JodaOrg/joda-time</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/KingJA/LoadSir</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/Kotlin/anko</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/LGDeveloper/QCircle-Design-Template</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/LGDeveloper/QCircle-Design-Template/wiki</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/LarsWerkman/HoloColorPicker</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/Malinskiy</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/Malinskiy/SuperRecyclerView</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/Malinskiy/android-material-icons</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/MarkusAmshove</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/MarkusAmshove/Kluent</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/PaoloRotolo/AppIntro</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/PhilJay/MPAndroidChart</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/Pixplicity/EasyPreferences</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/Pkmmte/CircularImageView</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/PlayWithAndroid/Android-PlatLogo</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/Raizlabs/DBFlow</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/ReactiveX/RxAndroid</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/ReactiveX/RxJava</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/ReactiveX/RxKotlin</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/TangoAgency/avatar-view</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/TangoAgency/material-intro-screen</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/Yalantis/Context-Menu.Android</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/Yalantis/Side-Menu.Android</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/aNNiMON/Lightweight-Stream-API</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/afollestad/assent</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/afollestad/bridge</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/afollestad/material-dialogs</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/airbnb/epoxy</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/akexorcist/Android-RoundCornerProgressBar</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/amlcurran</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/amlcurran/ShowcaseView</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/amulyakhare/TextDrawable</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/anjlab/android-inapp-billing-v3</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/apache/commons-compress</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/apache/commons-csv</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/apache/commons-lang</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/apache/ftpserver</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/apache/mina</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/arimorty/floatingsearchview</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/arimorty/floatingsearchview/blob/master/README.md</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/astuetz/PagerSlidingTabStrip</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/aurelhubert</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/aurelhubert/ahbottomnavigation</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/avast/android-styled-dialogs</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/balysv</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/balysv/material-menu</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/baoyongzhang/SwipeMenuListView</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/bluelinelabs/LoganSquare</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/brianwernick/ExoMedia</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/bumptech</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/bumptech/glide</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/bumptech/glide/blob/master/LICENSE</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/chrisbanes/ActionBar-PullToRefresh</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/chrisbanes/PhotoView</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/chrisjenx/Calligraphy</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/chrisjenx/Paralloid</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/code-troopers/android-betterpickers</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/daimajia/AndroidSwipeLayout</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/daimajia/AndroidViewAnimations</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/daimajia/AndroidViewHover</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/daimajia/AnimationEasingFunctions</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/daniel-stoneuk/material-about-library</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/davemorrissey</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/davemorrissey/subsampling-scale-image-view</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/devunwired/textdrawable</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/diogobernardino/WilliamChart</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/dlew/joda-time-android</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/edmodo/range-bar</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/edmund-wagner</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/einmalfel/Earl</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/emilsjolander/StickyListHeaders</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/evant</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/evant/gradle-retrolambda</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/evernote/android-job</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/excilys/androidannotations.git</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/fabiendevos</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/fabiendevos/nanotasks</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/facebook</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/facebook/rebound</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/foursquare/foursquare-android-oauth</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/frankiesardo</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/frankiesardo/icepick</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/futuresimple/android-floating-action-button</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/gabrielemariotti/cardslib</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/gabrielemariotti/colorpickercollection</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/gkopff</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/gkopff/gson-jodatime-serialisers</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/google/ExoPlayer</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/google/dagger</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/google/flexbox-layout</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/google/volley</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/googlei18n/libphonenumber</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/googlemaps/android-maps-utils</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/gotev/android-upload-service</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/greenrobot/EventBus</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/greenrobot/greenDAO</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/h6ah4i/android-advancedrecyclerview</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/h6ah4i/android-tablayouthelper</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/hdodenhof</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/hdodenhof/CircleImageView</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/hierynomus/sshj</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/hoang8f</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/hoang8f/android-flat-button</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/hotchemi</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/hotchemi/PermissionsDispatcher</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/iLexiconn/Magister.java</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/ismoli</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/ismoli/DynamicRecyclerView</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/javolution/jscience</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/jgilfelt/SystemBarTint</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/jhy/jsoup</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/jmdns/jmdns</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/junrar/junrar</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/keyboardsurfer/Crouton</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/kirich1409</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://github.com/kirich1409/StrictModeCompat</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://www.aescrypt.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://www.bouncycastle.org</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>2359media.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>about.me</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>actionbarsherlock.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>activeandroid.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>aescrypt.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>aidanfollestad.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>akexorcist.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>amlcurran.github.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>android.googlesource.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>androidannotations.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>apache.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>avast.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>axelrindle.de</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>baoyz.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>bitbucket.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>blog.wiresareobsolete.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>blog.zhanghai.me</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>bluelinelabs.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>bouncycastle.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>chris.banes.me</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>cloudrail.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>code-troopers.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>code.google.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>commons.apache.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>creativecommons.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>daimajia.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>daniel-stone.uk</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>danlew.net</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>devbrackets.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>developer.android.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>developer.lge.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>developers.facebook.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>diogobernardino.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>eduardereza.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>emilsjolander.se</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>facebook.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>facebook.github.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>fasterxml.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>flipboard.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>freepik.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>fsf.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>gmariotti.blogspot.it</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>gnu.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>google.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>gotev.net</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>greendao-orm.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>h6ah4i.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>hannesdorfmann.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>inthecheesefactory.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>jakewharton.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>jakewharton.github.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>javadude.nl</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>javolution.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>jeffgilfelt.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>jetbrains.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>jhy.io</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>joanzapata.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>joda-time.sourceforge.net</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>jscience.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>jsoup.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>koush.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>ksoichiro.blogspot.pt</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>ksoichiro.github.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>libphonenumber.googlecode.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>luke.klinker.xyz</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>malinskiy.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>michaelpardo.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>mikepenz.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>mixpanel.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>mixpanel.github.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>nineoldandroids.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>nostra13android.blogspot.co.at</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>npgall.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>opensource.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>orfjackal.net</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>orhanobut.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>paymill.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>piwai.info</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>qos.ch</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>reactivex.io</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>relex.me</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>robolectric.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>roomorama.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>satyan.github.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>scripts.sil.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>site.mockito.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>square.github.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>stfalcon.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>su.chainfire.eu</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>svn.apache.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>tozny.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>trello.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>twitter.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>umanoapp.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>viewpagerindicator.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>wasabeef.jp</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>wiki.fasterxml.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>williammora.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>wiresareobsolete.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>wittchen.biz.pl</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>wix.com</url>
              <origin>INPUT_FILE</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>L@gun._g</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>emmanuelbendavid@gmail.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>kweiner@fmsware.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>107.170.99.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>103.224.182.253</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>160.124.205.80</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>172.66.175.226</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.21.50.56</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>185.166.143.48</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>72.246.29.222</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>1.58.0.0</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>192.30.252.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>198.185.159.144</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>185.199.108.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>172.67.201.73</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>188.114.97.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>43.250.142.130</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>142.251.127.82</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>151.101.2.132</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>8162e448369f13560044dc19aa785533f07849d0e02dd0a4c5a8c7f1bde38494</SHA-256>
              <SHA-1>e9f85689b96ff8801072335692b0bb824fd6fe50</SHA-1>
              <MD5>813f2fe470a7c5bf53601eaeff4e1172</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>8aef3f9f27953a54a46b5b0bb44279a2c5cd90203ae913fed322003cb67bf5fc</SHA-256>
              <SHA-1>faba3bfe5d663775680ba41fa078d9435695f8c4</SHA-1>
              <MD5>6daab2bf4811badc79c142e4f72d58d8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>6957c256b2ba0fb479d232bbb3c0b9dcbdc148d42c181b1cd262fe5c9cbb55b8</SHA-256>
              <SHA-1>71f1d5293c4107180bce2f0b10cb76748f358356</SHA-1>
              <MD5>eb55fc7a020f75f2c063278d6e9fbe90</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>1c981755dda221664400da19679bae3a653a1ba40587e48d07e6c112fbe6b0c9</SHA-256>
              <SHA-1>d6d312ff58d503ac27704e741710893e0e2fef40</SHA-1>
              <MD5>d5febbfd0ad25fad9de4459948958219</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>dc99f436b479129676f911c4d78962f2f37e44360bdd914cc85a6aa649b78ff6</SHA-256>
              <SHA-1>f9aa2a6f345d4ae6a4709da7f286e5b47c53251c</SHA-1>
              <MD5>d2c1cb9a0488c7f6924f3d7d73348897</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>app-fdroid-release.apk</name>
        <report_id>a8c9fb7d-f2e2-42fd-93ed-8d3434236419</report_id>
        <tags>
          <value>apk</value>
          <value>html</value>
          <value>signed</value>
          <value>bash</value>
          <value>expand</value>
          <value>explorer</value>
          <value>lolbin</value>
          <value>anti-debug</value>
          <value>base64</value>
          <value>crypto</value>
          <value>evasive</value>
          <value>fingerprint</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>85fe17ed8d861794f45fef185763215358bb89b5b62d035228018c0e93f2a338</id>
    <title>Analysis Report for 85fe17ed8d861794f45fef185763215358bb89b5b62d035228018c0e93f2a338</title>
    <updated>2026-10-05T11:25:22Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38928d130e7ad45267441</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6ac3891f36412e623d2c8957</flow_id>
        <hash>85fe17ed8d861794f45fef185763215358bb89b5b62d035228018c0e93f2a338</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>84420d9911b70a2efbc67914eaa4396d4b5a8fd9ded346814c7da86daaecc397</SHA-256>
              <SHA-1>a3005bff9267a4a828fd60573d5d1783adf6c622</SHA-1>
              <MD5>4cc52d7d8fd7cb6dd29d10cce861600f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>b15316dc-6ce9-4b42-91b5-26be47225c98</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>85fe17ed8d861794.bin.elf</name>
        <report_id>9dda0750-6bd8-44ea-9263-a3ea5537442a</report_id>
        <tags>
          <value>elf</value>
          <value>masquerade</value>
        </tags>
        <verdict>UNKNOWN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T11:24:30Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac388fb89017dd18dc1bec0</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac388eddedbc9646d41b2ec</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>81b090c5-44af-4bd3-9681-854cb815c7e2</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T11:24:27Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac388f9d130e7ad45267438</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac388e8cd19289b120c3387</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>d5fbdc20-1901-4b12-9b16-3c3c7c211eb2</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>4ddf71ad4600a7e1751cd621e5ed3ff2600ab15cff8562c699d0ef1e52b1de03</id>
    <title>Analysis Report for 4ddf71ad4600a7e1751cd621e5ed3ff2600ab15cff8562c699d0ef1e52b1de03</title>
    <updated>2026-10-05T11:23:36Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac388bfd130e7ad4526742b</_id>
        <file_type>application/pdf</file_type>
        <flow_id>6ac388b636412e623d2c87a2</flow_id>
        <hash>4ddf71ad4600a7e1751cd621e5ed3ff2600ab15cff8562c699d0ef1e52b1de03</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>6ceaea23ca3a146106201c8d041b05e5651f6c4d208701fc9f58f2f7b0ff2d16</SHA-256>
              <SHA-1>69df77d6c304bec98433867bbd903cd6c44cd07c</SHA-1>
              <MD5>9500fcd63d02d99de9342864afc5ed88</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
          </files>
        </iocs>
        <name>RC_7572c725736eac813ff719ddb0332fcc_260922_183530.pdf</name>
        <report_id>278f580b-0e71-471c-8e99-a6ddf6e2a80f</report_id>
        <tags>
          <value>pdf</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>85c3a78178aaf336ecd05177505eb6576cf95b2bd10a950e6b51e4be5b8ef179</id>
    <title>Analysis Report for 85c3a78178aaf336ecd05177505eb6576cf95b2bd10a950e6b51e4be5b8ef179</title>
    <updated>2026-10-05T11:22:26Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac388e8d130e7ad45267434</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac38872cd19289b120c32df</flow_id>
        <hash>85c3a78178aaf336ecd05177505eb6576cf95b2bd10a950e6b51e4be5b8ef179</hash>
        <iocs>
          <urls>
            <value>
              <url>https://check.screenconnect.com/InstallerOriginInfo.axd</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://feedback.screenconnect.com/Feedback.axd</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>check.screenconnect.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>feedback.screenconnect.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>34.236.66.235</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>3.86.13.248</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>00c6fc2cfaa1b8b972cb4e155a4088491fbeda23cfbbb5d3135d94be65678650</SHA-256>
              <SHA-1>bb30b081d390eb511d86d4df3a70e6c21fe43b6c</SHA-1>
              <MD5>171fd7040d4d8279c73954fca1aa0b79</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>10bcf17b2919057dc9db40029ff1df5969a283ff0609a58663c36295f312257f</SHA-256>
              <SHA-1>03dc19ebbab03561c0ee120f4c993f726a9640f2</SHA-1>
              <MD5>e7cca018df49eb0a7b63cdc31bda0941</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8</SHA-256>
              <SHA-1>fc12d7ad112ddabfcd8f82f290d84e637a4d62f8</SHA-1>
              <MD5>b8e76ddb52d0eb41e972599ff3ca431b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>19ac323ca6eae2f8145cdc2bac865b32cd5a48ad6ff199d4ca7da214b056e1dc</SHA-256>
              <SHA-1>8bbb78a47c08867c50572f0bd2a27171f91e0454</SHA-1>
              <MD5>5fb6074b08ac4709cf2f29fa5b49023e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>29187cd5a1ac858c71e9056b4c5a0372b473b38a224d4652e65cb4f997a0ef96</SHA-256>
              <SHA-1>92ac355fe825683e6235cc0835fddfcfc06fffb1</SHA-1>
              <MD5>c183a895dc49c272ffb3757ca1c81712</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>361bbc692084841e4c8d22c89ca89c711d0fe17bc8759241736531a2f28de25b</SHA-256>
              <SHA-1>5ad8f5020613acfaa84259809c373cc144af9076</SHA-1>
              <MD5>72899e40e3d32282fd63c34b87b9385c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>39275ee04cde96a7be77efc1f5e94b42630ad79e728370d48f5c564c7c8c3f64</SHA-256>
              <SHA-1>cec39ee46ae818b7826aa090005153f85e68a0bc</SHA-1>
              <MD5>6f2479c6b5663ac245fabb8d25142905</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>402e9cfdd1a34293929e45edb1246fe304e411988cb53373d63a8fd2dbff55b7</SHA-256>
              <SHA-1>fdd61b6ce14065aac9b2371684ea3766cf22a2ad</SHA-1>
              <MD5>8197a6d441d6a358f5daea27c1ac7fe4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>4fbcc474ed004bf3448a5877a5ffc697350ff377ed8a71e4cb5e68fc274e623e</SHA-256>
              <SHA-1>d36b883012fbfc677f3a76ad55d30e121ac03a6e</SHA-1>
              <MD5>6da7b5a7c297229a62552873bf6d3c23</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a</SHA-256>
              <SHA-1>cac699787884fb993ced8d7dc47b7c522c7bc734</SHA-1>
              <MD5>b7db84991f23a680df8e95af8946f9c9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>60b5261b0aee55d34d73472a8935917e40ffea4d4ac49e4cdb3fe96a7675bec7</SHA-256>
              <SHA-1>096c31bc59a5dd0a9eafb3ab3ffc693ffc6d631b</SHA-1>
              <MD5>531e5a929d022ecf2cb1aef66ebaaf90</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>658e1d25fa3864bd477c025926e6ce700fba702f7a7b01ec8a5114a9da5436f4</SHA-256>
              <SHA-1>a9ce40fc24286133b247eb3a1388367d7a579d28</SHA-1>
              <MD5>944c97e9f13d448195fac6331c4941d8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>70652569f39888d8a3ec0d4c0efbbb20cd5aebc20edbc548a5950d06a09d80e6</SHA-256>
              <SHA-1>caa437660abb4682585bb29da0740e2dfcfdfb8b</SHA-1>
              <MD5>fbc1d996d88e5a2775097475d6f1c2ab</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>73ee1dfda728d262ef6db3f9a125ec6d40536a7bf6c22802f1116b69cc853b83</SHA-256>
              <SHA-1>0b78872db25f0ea15514fc2292eda3cbbdc87621</SHA-1>
              <MD5>e700d82df33389cd4ff0b3e87c96a54f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>74f2d225b492eb77a5654bcaafec5162d0c5f72de884daa4c32daf54e2bff3d7</SHA-256>
              <SHA-1>d9a6c9802092d9ec4e7e9eb0872127d74db4bfd4</SHA-1>
              <MD5>b759084c5614aacb33fec8faccd0c5ad</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>7e9cef578babf5cb06457d531f0961b35ccd53621e132ef04aa57a9a05d877d3</SHA-256>
              <SHA-1>91d49089ffea1f926eb7fe88aedbf970db835f09</SHA-1>
              <MD5>222c5d36db65ca65b38aa3bb8f53b6b6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>8421b7b9cf0d236be54c113b7f1360d8e1aad2504b671ed90a44d0ced7406c0e</SHA-256>
              <SHA-1>5ed3fcb5cacf71bb27397a1bfa8f1008376f930a</SHA-1>
              <MD5>b27760f51b4d733c2655c265aeb51b18</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>93f910f732855000861c1b4e6c55a2dee0a8cbb2172d89c7a2bc99053746c193</SHA-256>
              <SHA-1>5fbf0ba61aaaae5b506d78ca862286a676a61fbf</SHA-1>
              <MD5>9edc01ae0bafe0a1c610d9c8014ad563</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>9498ae5948f5b32d63f577beca440feb2318306c51e3ff4fc12d0d3718425735</SHA-256>
              <SHA-1>c8aa5d608571468c6429d5ecaa75fa3e6154cdb5</SHA-1>
              <MD5>efde6499988f9d97d32d21ef10381023</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>a00cb656a34b95ac1d061a24199fff7ecaa9af53c0d07d7316cafd89c9d7d10d</SHA-256>
              <SHA-1>abc75aa4cd1b48115b93cecbe2c26b077a8859b0</SHA-1>
              <MD5>0fdc238ae8cbfc0a39a9f88843f51216</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>a6722a61f671ef9613a5175d3db878598b93bb9276007cadfe762b5d575ad9a2</SHA-256>
              <SHA-1>29272596bd5f404137004ebd6426e88cabd86869</SHA-1>
              <MD5>097baeb608bae9e390a39ba5edafe6f5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>a87d765958d9c1b30c5063bef8457a1b4146b7dfc04d2eaae576d4560b7217cf</SHA-256>
              <SHA-1>d7ce22308cf16c0424aec8f0edd6a9f004d13e5f</SHA-1>
              <MD5>f9e2f39c6214b8dba59e4e0d209f2ae0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>a885072ef3bd767070136c9c050682d6088022d2aca58bdfb6f6f419952c6694</SHA-256>
              <SHA-1>14e61a74c35b656c5695234c48fcd5b62872baa4</SHA-1>
              <MD5>390c26a89defabfd93831c72b5da6427</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>add0df3fa2188e26899e1dda938a3f7b8f0ccf550e01ac77ff252c6fde61a59d</SHA-256>
              <SHA-1>dc0edbfc8b47603d449cb970522dabac8dc65118</SHA-1>
              <MD5>10072f22120e7adb9d0bc953a3b7966f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>b4a5a6e56e07eecd2d67823f7e01c20f305022b4e0ceb77688741dd420447fcc</SHA-256>
              <SHA-1>a0132f3aaa6744f7bde549c588ef8fa7ddd48623</SHA-1>
              <MD5>bb0f0c00ba0e923bd3f837098925206f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c20005b301ee50b34b5b78d07727afd11c83499cb8f8e5ea1272448315f28411</SHA-256>
              <SHA-1>2348e4b283ec9c2a53c1652ab4da56e7e7ab5bd3</SHA-1>
              <MD5>d84873f97883e28dc2c940addc279fb8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>c4e5572fc667e326c767dd297384c812cfeff194eb0a5692a6646a7bf00bbcc3</SHA-256>
              <SHA-1>1282222d1f85c9009967e4efe37d5e94ba5d0ea1</SHA-1>
              <MD5>77b9d59b3540ceeb5a96ab32d73c718f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c79639e9fdda3826d81d443f08f95f96f84a80477b894fb333e7161a060b750d</SHA-256>
              <SHA-1>f0ee3965cad8dd004b42f42ac1b207ee5d5c6153</SHA-1>
              <MD5>13bcd3f4d614b8956087af54cdb91462</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c8bdeb7fb127547b34aeec95f128315dfa419b61b8ff36c0d4244abc94652a1f</SHA-256>
              <SHA-1>240758a51323ca5deaf9647ae5f0584d7a3291d2</SHA-1>
              <MD5>7165a1371145a9fc69a44cf7898e32f9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>ce839aca785328440ee9ee2e5e0ab6dfeb83626185fe1938e2e70c5aa73d09cd</SHA-256>
              <SHA-1>fed7497d3d0cf111f658677767785c3a89e881ee</SHA-1>
              <MD5>743689736633d901a750654bbc945c79</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>cf4c8b1c729b8214556a4ca1943174571015bc975ebe06c3659893c26a96b9ab</SHA-256>
              <SHA-1>6ae337abf018d6faf5885ed9f910919e474e71d6</SHA-1>
              <MD5>6dc188f753ffb5d84dc50032e85ff60e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>db93544f2865c1745edeb90f08507bc73ea42e0dd42cd61e5add767d83b65f5a</SHA-256>
              <SHA-1>cb875cb475393c35ee4483075d8bb0419f832e00</SHA-1>
              <MD5>91608e19a788624d420fe0904647f366</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>289a4eea79baa4141744e44d60db713e18b5f23322663c63047962f51b467614</SHA-256>
              <SHA-1>06931bd96343ce167eda796112a30ca8d9fa536a</SHA-1>
              <MD5>48979a1a6d3badea8124bce04b1e01a5</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>808c61a09e220c361cff01e76c30f269e6c037c85069e0811662fd86c137874a</SHA-256>
              <SHA-1>d6159490c9024d7053241960671aa26a0ccc8579</SHA-1>
              <MD5>80e0336184ee640aa9318b02d255aac1</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>8a55c15cc76e31042e17458c479772aa95bc1b908016c85b1dc8b8e3eff23254</SHA-256>
              <SHA-1>5169602d641c4f2ebd9ca0639622949e00c25566</SHA-1>
              <MD5>decb1fd20d75e6eade9289cc24605f29</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>9342c7be8036a5f8dc3895d75e3314dce961fd3bc70ee59928c67fa04f0c7e08</SHA-256>
              <SHA-1>cf49072c50456381cd26cd32cb97606c5f5cfd26</SHA-1>
              <MD5>5419ff27205d3e5affa3fc18b811b843</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>ad6062215032ab58369403b1221562b5e7fb5ae7d52b29b7fad69eefb2d8455b</SHA-256>
              <SHA-1>ac6ab994beaff69adf8a2dc480a8a628175ff6c8</SHA-1>
              <MD5>723f2aaeeda1d2bb2f49322da349ffc9</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>e4b29e87ae288199964726c10ea221827cfde794c2aee17f71f4561cd09bf472</SHA-256>
              <SHA-1>d44024116695f61f35d219af176ca1dff371b222</SHA-1>
              <MD5>95e483ac0872859afbf474ea322006d4</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>524ff283-2094-4f98-b68d-f24f61c5f8fa</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>ScreenConnect.ClientSetup (3).exe</name>
        <report_id>6bb010cf-48a6-41dd-b4cf-3c55f303cc24</report_id>
        <tags>
          <value>peexe</value>
          <value>corrupted</value>
          <value>evasive</value>
          <value>packed</value>
          <value>anti-debug</value>
          <value>base64</value>
          <value>privilege</value>
          <value>reconnaissance</value>
          <value>overlay</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>039c46d46e69a2674d46321f98c107867164335c64afc78021c3e93c8549ea70</id>
    <title>Analysis Report for 039c46d46e69a2674d46321f98c107867164335c64afc78021c3e93c8549ea70</title>
    <updated>2026-10-05T11:21:05Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3888bd130e7ad45267422</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac38820cd19289b120c3258</flow_id>
        <hash>039c46d46e69a2674d46321f98c107867164335c64afc78021c3e93c8549ea70</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.researchandmarkets.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://edition.cnn.com/2021/11/02/tech/foodmarble-aire-hydrogen-breath-test-spc-intl/index.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://eu.usatoday.com/story/travel/news/2021/12/11/active-vacations-bike-hike-paddle-cook-bucket-list-locations/6421695001</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ie.linkedin.com/company/research-and-markets</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a-/ALV-UjUEXKD7awfUKeS8jqnKOaTwFKzu1CMU--BOU0mKoggFtQ=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a-/ALV-UjUIzrBIJ6RRs3Hwp34xvlTIOUBdwvTjqLAh2TEJgcjCwuEGjwsGBA=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a-/ALV-UjUlia_AX1_YRGxNBJVvPL7RESHyxscu6SjaRHtLpwBW-qyY4bjL=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a-/ALV-UjVyXUtJ3J6F5sG5olAxXdYcdbs2XGiEHgHQXfs9qaxD7hHffVgO=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a-/ALV-UjW68KuP7divAnm-7wNa64jg2mqLlt5zxSbis42J2Cb3LcRddYrnwg=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a-/ALV-UjXRZ7PWQOYZ5fh-gkIrY4rGsItv0VIbxoy-lthJOyWzv0ST8nXd=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a-/ALV-UjX_3eB0TySIDdDszL-sx8m9BmK8FLvEDMuxaGf3FOhq4T8egNjE3w=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocI21caDrWiA1GIZRrG4ADMdg8X1YBu5rf4TUTjQh5ED7gKfeA=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocIURKT3ruZn2EWFl8SKSTvEbinCu_25NLHArBw6fTTMtD3Q7g=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocIXVD9WqoxU6SRS1BkOyY4TyVi-nLR6Tefd_uKrFgZrpt48bw=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocIlUU96dyn5C3o-6zjP_673WWpXYXe1Ncp9eNjBmQmb8z_88A=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocIt1qWerm-59DfHX3LpieaS-s0_IfTYYoUUQs3EXLZbcinO=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocIxin2CabJfATEHUctjrLcDZr-MAW3LVmgLdHVJ_gc0T6Ma7w=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocJktsZP_gqJtnzFA1juzjURRd1VFpcwcfhfmkip8Jrf6Iww7g=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocJxOkNkDOEFi7sPQhx7055YuFPp-acWe9RVFNArbpYxZrmkXA=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocKqFK8mWfV8FZxzUJWLHDRX6_Hasdp2IapiXuIaVhUHPMqm7w=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocL0-QAvbI7yrG_YPW7i1SdIR-jBDlTGIhlCYfd8f-UWgV_7ew=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocL2wo8C4O0dol7ZH3VIV1_YEzFvs-jrrSWFBOYGeP-WGCgEFQ=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocLM0B3tTxwxEGv4rSs4V6JO2t4P47nGNLj7WzccSXGKFQzPiA=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocLOk_wP1wb1EFg221GuknuK8EycI599n7pfeR-Ofve9hO4wdA=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocLOmRbfPeAuv81GzNFQ9yCX0HGTdSCCfPHSCzVl7Hhd3lVEGg=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocLQPkyDrjQ2rtZ9NugaYUp10ZmAbqthWOjDwC_VdfTIoqIMdg=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocLslcmyJQnZv2AblxSRWJwJ3CwTAlro9UM8LnNW_AIWFOPITg=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/AEdFTp4DLHO9UI85f7wC_CSa6wUgxjr43dRoNX0bqTMg=s120-c-c0x00000000-cc-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/AEdFTp4SUSIGewOhwgjGk-4jETBCnlWemJcBVv6JQdBv=s120-c-c0x00000000-cc-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/AEdFTp4Wnhaj4c2crsMPkLwxdZWfD3_ULaT3iDpn3L1o=s120-c-c0x00000000-cc-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/AEdFTp60KhubPZJSZd-zjkyx4l58uvdFucH23E6Aa2KN=s120-c-c0x00000000-cc-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/AEdFTp74ClIxsYkJbv26iwlMurX3xHF9Ics9GI06rrze=s120-c-c0x00000000-cc-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/AGNmyxYk4JIFECmbljBg27zXGuM3a9fUEaOixXu_o7nm=s120-c-c0x00000000-cc-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/AGNmyxaZJGYqK-qJL6uMTor7by9kJgBenCYE-hVoQ0lk=s120-c-c0x00000000-cc-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://publishers.researchandmarkets.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://time.com/6131320/digital-twins-uses</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://twitter.com/researchmarkets</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.bbc.com/news/business-56320899</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.bloomberg.com/press-releases/2021-12-03/ovation-science-provides-an-update-on-its-topical-cannabis-research-and-development-efforts-kwqe9vzv</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.economist.com/business/2022/03/26/botox-and-other-injectable-cosmetics-are-booming</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.forbes.com/sites/greatspeculations/2022/03/28/dominos-pizza-delivering-a-superior-business-model/?sh=27a548cf2042</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=GTM-KPC7CQN</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/ns.html?id=GTM-KPC7CQN</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.insiderintelligence.com/insights/remote-patient-monitoring-companies-startups</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/research-and-markets</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.nytimes.com/2021/05/11/business/covid-weight-loss-companies.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/logo.png</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/search.asp?q=%7Bsearch_term_string%7D</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.reuters.com/markets/us/solana-ventures-forte-griffin-invest-150-million-blockchain-gaming-2021-12-14</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.washingtonpost.com/wellness/2022/01/11/are-detox-juice-cleanses-necessary</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.wsj.com/articles/google-aims-for-commercial-grade-quantum-computer-by-2029-11621359156</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ad.doubleclick.net/ccm/s/collect?auid=1897392693.1791199325&amp;gtm=45He69u2v76435191za200zd76435191xeaxf1&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.com/bat.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.com/p/action/5439471.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.net/action/0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.net/action/0?ti=5439471&amp;tm=gtm002&amp;Ver=2&amp;mid=057ea771-e4e1-444b-90fc-1f2b5d6f1d1d&amp;bo=2&amp;pi=918639831&amp;lg=en-US&amp;sw=800&amp;sh=600&amp;sc=24&amp;nwd=1&amp;tl=Research%20and%20Markets%20-%20Market%20Research%20Reports%20-%20Welcome&amp;p=https%3A%2F%2Fwww.researchandmarkets.com%2F&amp;r=&amp;lt=317&amp;evt=pageLoad&amp;sv=2&amp;asc=D&amp;cdb=AQAY&amp;rn=279888</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.net/actionp/0?ti=5439471&amp;tm=gtm002&amp;Ver=2&amp;mid=057ea771-e4e1-444b-90fc-1f2b5d6f1d1d&amp;bo=1&amp;evt=consent&amp;src=enforced&amp;cdb=AQAY&amp;asc=D</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://edition.cnn.com/2021/11/02/tech/foodmarble-aire-hydrogen-breath-test-spc-intl/index.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://eu.usatoday.com/story/travel/news/2021/12/11/active-vacations-bike-hike-paddle-cook-bucket-list-locations/6421695001</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://publishers.researchandmarkets.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.analytics.google.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.analytics.google.com/g/collect?v=2&amp;tid=G-HER5SHVQ13&amp;gtm=45je69u2v889702130z876435191za20gzb76435191zd76435191xf1&amp;_p=1791199325302&amp;_gaz=1&amp;gcd=13l3l3l2l1l1&amp;npa=1&amp;dma_cps=a&amp;dma=1&amp;_eu=EAAAACAC&amp;are=1&amp;cid=1204877944.1791199325&amp;frm=0&amp;ibt=1&amp;ir=1&amp;ngs=1&amp;pscdl=noapi&amp;rcb=11&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;_s=1&amp;tag_exp=115938465~115938468~118897920~118897930~120213116~120385422~120412528~120469145~120469153~121246027~121246035~121427143&amp;cu=EUR&amp;sid=1791199325&amp;sct=1&amp;seg=0&amp;dl=https%3A%2F%2Fwww.researchandmarkets.com%2F&amp;dt=Research%20and%20Markets%20-%20Market%20Research%20Reports%20-%20Welcome&amp;en=view_item_list&amp;_fv=1&amp;_nsi=1&amp;_ss=1&amp;pr1=id3261664~nmRoyalty%20Rates%20in%20Pharmaceutical%20and%20Biotechnology%20Licensing%20Deals%202015-2026~pr4623~brCurrentPartnering~vaReport~li~k0dimension14~v0~k1currency~v1EUR~lnHome%20Page%20Best%20Sellers~lp1&amp;pr2=id5321798~nmArtificial%20Intelligence%20Market%20by%20Offering%2C%20Technology%2C%20Business%20Function%20-%20Global%20Forecast%20to%202033~pr4581~brMarkets%20and%20Markets~vaReport~li~k0dimension14~v0~k1currency~v1EUR~lnHome%20Page%20Best%20Sellers~lp2&amp;pr3=id5807049~nmCoffee%20Market%20Report%202026~pr4155~brThe%20Business%20Research%20Company~vaReport~li~k0dimension14~v0~k1currency~v1EUR~lnHome%20Page%20Best%20Sellers~lp3&amp;pr4=id5239211~nmHVAC%20Market%202026-2030~pr2314~brTechNavio~vaReport~li~k0dimension14~v0~k1currency~v1EUR~lnHome%20Page%20Best%20Sellers~lp4&amp;pr5=id5511285~nmGlobal%20Mining%20Directory~pr302~brAsia%20Pacific%20Infoserv~vaDirectory~li~k0dimension14~v0~k1currency~v1EUR~lnHome%20Page%20Best%20Sellers~lp5&amp;tfd=568</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://stats.g.doubleclick.net/g/collect?v=2&amp;ngs=1&amp;ibt=1&amp;tid=G-HER5SHVQ13&amp;cid=1204877944.1791199325&amp;gtm=45je69u2v889702130z876435191za20gzb76435191zd76435191xf1&amp;rcb=11&amp;aip=1&amp;dma=1&amp;dma_cps=a&amp;gcd=13l3l3l2l1l1&amp;npa=1&amp;frm=0&amp;tag_exp=115938465~115938468~118897920~118897930~120213116~120385422~120412528~120469145~120469153~121246027~121246035~121427143</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://time.com/6131320/digital-twins-uses</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://twitter.com/researchmarkets</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.bbc.com/news/business-56320899</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.bloomberg.com/press-releases/2021-12-03/ovation-science-provides-an-update-on-its-topical-cannabis-research-and-development-efforts-kwqe9vzv</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economist.com/business/2022/03/26/botox-and-other-injectable-cosmetics-are-booming</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.forbes.com/sites/greatspeculations/2022/03/28/dominos-pizza-delivering-a-superior-business-model/?sh=27a548cf2042</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect?rcb=0&amp;frm=0&amp;apvc=0&amp;ae=g&amp;auid=1897392693.1791199325&amp;dt=Research%20and%20Markets%20-%20Market%20Research%20Reports%20-%20Welcome&amp;tid=AW-1070844149&amp;dl=https%3A%2F%2Fwww.researchandmarkets.com%2F&amp;scrsrc=www.googletagmanager.com&amp;rnd=500530030.1791199325&amp;navt=n&amp;npa=1&amp;_tu=CA&amp;gtm=45be69u2v9178959160z876435191za20gzb76435191zd76435191xeaxf1&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938465~115938468~118897920~118897930~120213116~120385423~120469145~120469153&amp;tft=1791199325560&amp;tfd=674&amp;tids=AW-1070844149&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect?rcb=10&amp;frm=0&amp;apvc=1&amp;ae=g&amp;auid=1897392693.1791199325&amp;dt=Research%20and%20Markets%20-%20Market%20Research%20Reports%20-%20Welcome&amp;en=page_view&amp;dl=https%3A%2F%2Fwww.researchandmarkets.com%2F&amp;scrsrc=www.googletagmanager.com&amp;rnd=500530030.1791199325&amp;navt=n&amp;npa=1&amp;ep.ads_data_redaction=0&amp;gtm=45He69u2v76435191za200zd76435191xeaxf1&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938465~115938468~118897920~118897930~120385423~120469145~120469153&amp;tft=1791199325341&amp;tfd=456&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.de/ads/ga-audiences?v=1&amp;t=sr&amp;slf_rd=1&amp;_r=4&amp;ngs=1&amp;ibt=1&amp;tid=G-HER5SHVQ13&amp;cid=1204877944.1791199325&amp;gtm=45je69u2v889702130z876435191za20gzb76435191zd76435191xf1&amp;rcb=11&amp;aip=1&amp;dma=1&amp;dma_cps=a&amp;gcd=13l3l3l2l1l1&amp;npa=1&amp;frm=0&amp;tag_exp=115938465~115938468~118897920~118897930~120213116~120385422~120412528~120469145~120469153~121246027~121246035~121427143&amp;z=1576517446</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/destination?id=AW-1070844149&amp;cx=c&amp;gtm=4e69u2</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/destination?id=G-HER5SHVQ13&amp;cx=c&amp;gtm=4e69u2</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-HER5SHVQ13&amp;cx=c&amp;gtm=4e69u2</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=GTM-KPC7CQN</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.insiderintelligence.com/insights/remote-patient-monitoring-companies-startups</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/research-and-markets</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.nytimes.com/2021/05/11/business/covid-weight-loss-companies.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/#1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/#2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/#3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/#main-nav-content</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Common/ExchangeRates</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Common/GoogleReviews</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Common/LogHttpRequest</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/KFOlCnqEu92Fr1MmEU9fBBc4.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/KFOlCnqEu92Fr1MmSU5fBBc4.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/KFOlCnqEu92Fr1MmWUlfBBc4.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/KFOlCnqEu92Fr1MmYUtfBBc4.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/KFOmCnqEu92Fr1Mu4mxK.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/fontawesome-webfont.woff</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/fontawesome-webfont.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/icomoon.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Home/GetHomePageProducts</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Home/SetCountryCodeCookie</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Scripts/plugins/v-639233294500000000/tiny-slider.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Styles/font-awesome-4.0.3-custom.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Styles/fonts-googleapis-com-20-roboto-custom.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Styles/v-639233294500000000/tiny-slider.min.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Styles/v-639233295280000000/InfoAndContentCore.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/bundles/views/v-639233295320000000/categoryAndSearchPages.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/bundles/views/v-639233295320000000/contentInfoPages.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/bundles/views/v-639233295340000000/js-core.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1069/BTGroupPLC.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1070/HarrodsLtd.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1076/KelloggCo.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1085/FordMotorCompany.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1104/CreditSuisseGroup.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1118/DukeUniversity.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1123/HeinzCompany.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1137/UBSAG.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1184/EONSE.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1199/IMAXCorporation.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1212/InnocentDrinksLtd.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1267/HiltonWorldwide.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1286/SwissReinsuranceCompanyLtd.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1294/GenDigitalInc.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1316/NBCUniversalInc.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1377/CarrefourSA.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1392/LindtSprngliAG.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1500/GlanbiaPlc.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1505/TelenorGroup.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1506/TiffanyCo.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1507/SonocoProductsCompany.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/2222/TheEsteeLauderCompaniesInc.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/547/GlaxoSmithKlinePLC.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/551/PhilipsNV.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/557/RocheDiagnosticsLtd.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/582/AbbottLaboratoriesLtd.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/611/BostonConsultingGroup.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/614/SamsungElectronicsCoLtd.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/653/HoneywellInternationalInc.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/676/CiscoSystemsInc.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/732/ProcterGambleCo.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/777/DuPontCompany.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/788/VolvoCarCorporation.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/791/GoogleInc.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/798/GoodyearTireRubberCompany.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/819/HexcelCorporation.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/841/WesternUnionCompany.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/853/DHLInternationalGmbH.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/901/UnileverNV.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/941/MicrosoftCorporation.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/952/GroupeDanone.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/975/BayerAG.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/favicon.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/header-sprite.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/home/home-hero-bg.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/icon-nav-sprite-4.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/logo.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/our-services-icons/icon-conferences-and-training.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/our-services-icons/icon-consultancy.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/our-services-icons/icon-custom-research.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/our-services-icons/icon-market-research-store.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/our-services-icons/icon-subscriptions.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-bbc.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-bloomberg.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-business-insider.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-cnn.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-forbes.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-reuters.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-the-economist.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-the-new-york-times.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-the-wall-street-journal.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-the-washington-post.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-time-magazine.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-usa-today.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/product_images/11761/11761448_115px_jpg/royalty_rates_in_pharmaceutical_and_biotechnology_licensing_deals.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/product_images/12006/12006524_115px_jpg/artificial_intelligence_market.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/product_images/12128/12128713_115px_jpg/hvac_market.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/product_images/12189/12189942_115px_jpg/global_mining_directory.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/product_images/12487/12487885_115px_jpg/coffee_market.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.reuters.com/markets/us/solana-ventures-forte-griffin-invest-150-million-blockchain-gaming-2021-12-14</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.washingtonpost.com/wellness/2022/01/11/are-detox-juice-cleanses-necessary</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wsj.com/articles/google-aims-for-commercial-grade-quantum-computer-by-2029-11621359156</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/&amp;dt=Research</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/&amp;r=&amp;lt=317&amp;evt=pageLoad&amp;sv=2&amp;asc=D&amp;cdb=AQAY&amp;rn=279888</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/&amp;scrsrc=www.googletagmanager.com&amp;rnd=500530030.1791199325&amp;navt=n&amp;npa=1&amp;_tu=CA&amp;gtm=45be69u2v9178959160z876435191za20gzb76435191zd76435191xeaxf1&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938465~115938468~118897920~118897930~120213116~120385423~120469145~120469153&amp;tft=1791199325560&amp;tfd=674&amp;tids=AW-1070844149&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/&amp;scrsrc=www.googletagmanager.com&amp;rnd=500530030.1791199325&amp;navt=n&amp;npa=1&amp;ep.ads_data_redaction=0&amp;gtm=45He69u2v76435191za200zd76435191xeaxf1&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938465~115938468~118897920~118897930~120385423~120469145~120469153&amp;tft=1791199325341&amp;tfd=456&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>ad.doubleclick.net</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>bat.bing.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>bat.bing.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>edition.cnn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>eu.usatoday.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>publishers.researchandmarkets.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>region1.analytics.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>stats.g.doubleclick.net</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>time.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>twitter.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.bbc.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.bloomberg.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.forbes.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.de</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.insiderintelligence.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.nytimes.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.researchandmarkets.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.reuters.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.washingtonpost.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.wsj.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>edition.cnn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>eu.usatoday.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>ie.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>lh3.googleusercontent.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>publishers.researchandmarkets.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>time.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>twitter.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.bbc.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.bloomberg.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.economist.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.forbes.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.insiderintelligence.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.nytimes.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.researchandmarkets.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.reuters.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.washingtonpost.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.wsj.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>company-message-bg@2x.jpg</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>your@email.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>151.101.3.5</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>146.75.121.73</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>13.33.187.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.67.138.91</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>146.75.122.62</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>162.159.140.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>146.75.120.81</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>146.75.121.164</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>34.225.248.224</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.41.41</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.50.2.62</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>146.75.121.55</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>151.101.195.52</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.64.145.237</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.132</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.148</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.154</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.14.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.156.119</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>146.75.122.49</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>150.171.27.10</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>150.171.29.10</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>216.239.34.36</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>146.75.122.49</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>58c1583be6a3b7c9edda1b065a32b4cfe9330894da070e8fbcfc2ad8ea5a37e0</SHA-256>
              <SHA-1>52f0139caeb314f9d003d84c2e044fb61a1557a9</SHA-1>
              <MD5>c3226f96ab2105e0ba4f475c236d8261</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>439b18ce13f70e895f5c2e07c70d1b3424c8597432985a982b7c5d19795dfb6b</SHA-256>
              <SHA-1>a1c1f7bdb5a47f3509488d34b50123f940fbf1a7</SHA-1>
              <MD5>93c194e773c9fa345c8a234880192585</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>0315faf29c8c1591c7fab355261e857da47215122672a7a5ca074b90b88434f8</SHA-256>
              <SHA-1>49bfd981dc6073581151407449b3c3270b9f2b72</SHA-1>
              <MD5>0eba4493fdf9d185899b323a49235de8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>b33acc76296910e3df619bb8615d2c248b3dda91adf55de8bc4a52d48cb76441</SHA-256>
              <SHA-1>2de5b2acff820db3b6e9bd25beea6143c2184eb6</SHA-1>
              <MD5>e1252487dd6222f2f39b801bdafe891e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>329cf248f43935907f26b5f67cd483cf47674efd367e63bacdf08c49d54416e5</SHA-256>
              <SHA-1>ec8626aa01fbfd43b9ee2fcf8747ed27f025734c</SHA-1>
              <MD5>f34af926da841862be7e21b5e0076dd5</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>824daa32f45e7640de3a88703a78b5818a17a441c69d0f183db0ffa8815650b0</SHA-256>
              <SHA-1>9d136583905c07e86fdffdb59851f7a293167292</SHA-1>
              <MD5>2b24209f823512728089e461233d1d81</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>263ff8cfbeb24b91f038f5933a6c2678b4622b4269b25d955bf75a9f29b26d93</SHA-256>
              <SHA-1>e1cd9025da5a930828393dd3cf38c4bda68903ca</SHA-1>
              <MD5>4f2c826383fa530c36ad9731aab7a5c6</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>bb0aa3200cb69f408c9c36fedd3c2fddf994757f73e1dd4be005ed3b462a5fe1</SHA-256>
              <SHA-1>2bff050f2bb29bb98510eea253678b303885acf3</SHA-1>
              <MD5>8d96bfccc482989eec81b088234cdaa2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>32baaf6043e32c4cce8ce87489859f356ebe632d9fc733d70b35b1de5ceeaa78</SHA-256>
              <SHA-1>7f1ed5fbfcaab371daaae1c64a43a1b15ab9566a</SHA-1>
              <MD5>feeab7e6ef45c4cea5747dcd5ad729ba</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>5916af6f0f6ac84923be83176982dd1ac082e07be299be1bf5e93065ea42487a</SHA-256>
              <SHA-1>4966d9c763628a72c7d5baf06c6dbbcf4dd574c5</SHA-1>
              <MD5>6b682fc2fa822440cc943c7ba13c9c13</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://www.researchandmarkets.com/</name>
        <report_id>daaa173d-4b77-4a9e-b893-c332b9dbb6ad</report_id>
        <tags>
          <value>html</value>
          <value>png</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>acbfbf61725a577910a658612603e479a71ad8d305ee6600b780ca8cd19e3b88</id>
    <title>Analysis Report for acbfbf61725a577910a658612603e479a71ad8d305ee6600b780ca8cd19e3b88</title>
    <updated>2026-10-05T11:21:04Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3885d89017dd18dc1bea2</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac3882036412e623d2c857e</flow_id>
        <hash>acbfbf61725a577910a658612603e479a71ad8d305ee6600b780ca8cd19e3b88</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.researchandmarkets.com/?subject=unsubscribe</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://ad.doubleclick.net/ccm/s/collect?auid=311969142.1791199268&amp;gtm=45He69u2h1v76435191za200zd76435191xeaxf1&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.com/bat.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.com/p/action/5439471.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.net/action/0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.net/action/0?ti=5439471&amp;tm=gtm002&amp;Ver=2&amp;mid=b9f2d03f-75c0-44d2-9c15-065d607650f4&amp;bo=2&amp;pi=918639831&amp;lg=en-US&amp;sw=800&amp;sh=600&amp;sc=24&amp;nwd=1&amp;tl=Research%20and%20Markets%20-%20Market%20Research%20Reports%20-%20Welcome&amp;p=https%3A%2F%2Fwww.researchandmarkets.com%2F%3Fsubject%3Dunsubscribe&amp;r=&amp;lt=330&amp;evt=pageLoad&amp;sv=2&amp;asc=D&amp;cdb=AQAY&amp;rn=547775</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.net/actionp/0?ti=5439471&amp;tm=gtm002&amp;Ver=2&amp;mid=b9f2d03f-75c0-44d2-9c15-065d607650f4&amp;bo=1&amp;evt=consent&amp;src=enforced&amp;cdb=AQAY&amp;asc=D</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://edition.cnn.com/2021/11/02/tech/foodmarble-aire-hydrogen-breath-test-spc-intl/index.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://eu.usatoday.com/story/travel/news/2021/12/11/active-vacations-bike-hike-paddle-cook-bucket-list-locations/6421695001</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://publishers.researchandmarkets.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.analytics.google.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.analytics.google.com/g/collect?v=2&amp;tid=G-HER5SHVQ13&amp;gtm=45je69u2h1v889702130z876435191za20gzb76435191zd76435191xf1&amp;_p=1791199267698&amp;_gaz=1&amp;gcd=13l3l3l2l1l1&amp;npa=1&amp;dma_cps=a&amp;dma=1&amp;_eu=EAAAACAC&amp;are=1&amp;cid=1320001231.1791199268&amp;frm=0&amp;ibt=1&amp;ir=1&amp;ngs=1&amp;pscdl=noapi&amp;rcb=14&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;_s=1&amp;tag_exp=115938465~115938469~118897920~118897930~120213116~120385423~120469145~120469153~121246027~121246035~121280971&amp;cu=EUR&amp;sid=1791199267&amp;sct=1&amp;seg=0&amp;dl=https%3A%2F%2Fwww.researchandmarkets.com%2F%3Fsubject%3Dunsubscribe&amp;dt=Research%20and%20Markets%20-%20Market%20Research%20Reports%20-%20Welcome&amp;en=view_item_list&amp;_fv=1&amp;_nsi=1&amp;_ss=1&amp;pr1=id3261664~nmRoyalty%20Rates%20in%20Pharmaceutical%20and%20Biotechnology%20Licensing%20Deals%202015-2026~pr4623~brCurrentPartnering~vaReport~li~k0dimension14~v0~k1currency~v1EUR~lnHome%20Page%20Best%20Sellers~lp1&amp;pr2=id5321798~nmArtificial%20Intelligence%20Market%20by%20Offering%2C%20Technology%2C%20Business%20Function%20-%20Global%20Forecast%20to%202033~pr4581~brMarkets%20and%20Markets~vaReport~li~k0dimension14~v0~k1currency~v1EUR~lnHome%20Page%20Best%20Sellers~lp2&amp;pr3=id5807049~nmCoffee%20Market%20Report%202026~pr4155~brThe%20Business%20Research%20Company~vaReport~li~k0dimension14~v0~k1currency~v1EUR~lnHome%20Page%20Best%20Sellers~lp3&amp;pr4=id5239211~nmHVAC%20Market%202026-2030~pr2314~brTechNavio~vaReport~li~k0dimension14~v0~k1currency~v1EUR~lnHome%20Page%20Best%20Sellers~lp4&amp;pr5=id5511285~nmGlobal%20Mining%20Directory~pr302~brAsia%20Pacific%20Infoserv~vaDirectory~li~k0dimension14~v0~k1currency~v1EUR~lnHome%20Page%20Best%20Sellers~lp5&amp;tfd=579</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://stats.g.doubleclick.net/g/collect?v=2&amp;ngs=1&amp;ibt=1&amp;tid=G-HER5SHVQ13&amp;cid=1320001231.1791199268&amp;gtm=45je69u2h1v889702130z876435191za20gzb76435191zd76435191xf1&amp;rcb=14&amp;aip=1&amp;dma=1&amp;dma_cps=a&amp;gcd=13l3l3l2l1l1&amp;npa=1&amp;frm=0&amp;tag_exp=115938465~115938469~118897920~118897930~120213116~120385423~120469145~120469153~121246027~121246035~121280971</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://time.com/6131320/digital-twins-uses</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://twitter.com/researchmarkets</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.bbc.com/news/business-56320899</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.bloomberg.com/press-releases/2021-12-03/ovation-science-provides-an-update-on-its-topical-cannabis-research-and-development-efforts-kwqe9vzv</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economist.com/business/2022/03/26/botox-and-other-injectable-cosmetics-are-booming</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.forbes.com/sites/greatspeculations/2022/03/28/dominos-pizza-delivering-a-superior-business-model/?sh=27a548cf2042</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect?rcb=5&amp;frm=0&amp;apvc=0&amp;ae=g&amp;auid=311969142.1791199268&amp;dt=Research%20and%20Markets%20-%20Market%20Research%20Reports%20-%20Welcome&amp;tid=AW-1070844149&amp;dl=https%3A%2F%2Fwww.researchandmarkets.com%2F%3Fsubject%3Dunsubscribe&amp;scrsrc=www.googletagmanager.com&amp;rnd=354609279.1791199268&amp;navt=n&amp;npa=1&amp;_tu=CA&amp;gtm=45be69u2h1v9178959160z876435191za20gzb76435191zd76435191xeaxf1&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938465~115938469~117776796~118897920~118897930~120213116~120385423~120469145~120469153~121046262~121046270~121246027~121246035~121280971&amp;tft=1791199267956&amp;tfd=699&amp;tids=AW-1070844149&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect?rcb=9&amp;frm=0&amp;apvc=1&amp;ae=g&amp;auid=311969142.1791199268&amp;dt=Research%20and%20Markets%20-%20Market%20Research%20Reports%20-%20Welcome&amp;en=page_view&amp;dl=https%3A%2F%2Fwww.researchandmarkets.com%2F%3Fsubject%3Dunsubscribe&amp;scrsrc=www.googletagmanager.com&amp;rnd=354609279.1791199268&amp;navt=n&amp;npa=1&amp;ep.ads_data_redaction=0&amp;gtm=45He69u2h1v76435191za200zd76435191xeaxf1&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938465~115938468~117776796~118897920~118897930~120385423~120469145~120469153~121280971&amp;tft=1791199267730&amp;tfd=472&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.de/ads/ga-audiences?v=1&amp;t=sr&amp;slf_rd=1&amp;_r=4&amp;ngs=1&amp;ibt=1&amp;tid=G-HER5SHVQ13&amp;cid=1320001231.1791199268&amp;gtm=45je69u2h1v889702130z876435191za20gzb76435191zd76435191xf1&amp;rcb=14&amp;aip=1&amp;dma=1&amp;dma_cps=a&amp;gcd=13l3l3l2l1l1&amp;npa=1&amp;frm=0&amp;tag_exp=115938465~115938469~118897920~118897930~120213116~120385423~120469145~120469153~121246027~121246035~121280971&amp;z=1356570840</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/destination?id=AW-1070844149&amp;cx=c&amp;gtm=4e69u2h1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/destination?id=G-HER5SHVQ13&amp;cx=c&amp;gtm=4e69u2h1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-HER5SHVQ13&amp;cx=c&amp;gtm=4e69u2h1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=GTM-KPC7CQN</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.insiderintelligence.com/insights/remote-patient-monitoring-companies-startups</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/research-and-markets</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.nytimes.com/2021/05/11/business/covid-weight-loss-companies.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/?subject=unsubscribe</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/?subject=unsubscribe#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/?subject=unsubscribe#1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/?subject=unsubscribe#2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/?subject=unsubscribe#3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/?subject=unsubscribe#main-nav-content</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Common/ExchangeRates</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Common/GoogleReviews</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Common/LogHttpRequest</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/KFOlCnqEu92Fr1MmEU9fBBc4.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/KFOlCnqEu92Fr1MmSU5fBBc4.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/KFOlCnqEu92Fr1MmWUlfBBc4.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/KFOlCnqEu92Fr1MmYUtfBBc4.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/KFOmCnqEu92Fr1Mu4mxK.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/fontawesome-webfont.woff</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/fontawesome-webfont.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/icomoon.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Home/GetHomePageProducts</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Home/SetCountryCodeCookie</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Scripts/plugins/v-639233294500000000/tiny-slider.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Styles/font-awesome-4.0.3-custom.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Styles/fonts-googleapis-com-20-roboto-custom.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Styles/v-639233294500000000/tiny-slider.min.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Styles/v-639233295280000000/InfoAndContentCore.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/bundles/views/v-639233295320000000/categoryAndSearchPages.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/bundles/views/v-639233295320000000/contentInfoPages.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/bundles/views/v-639233295340000000/js-core.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1069/BTGroupPLC.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1070/HarrodsLtd.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1076/KelloggCo.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1085/FordMotorCompany.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1104/CreditSuisseGroup.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1118/DukeUniversity.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1123/HeinzCompany.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1137/UBSAG.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1184/EONSE.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1199/IMAXCorporation.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1212/InnocentDrinksLtd.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1267/HiltonWorldwide.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1286/SwissReinsuranceCompanyLtd.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1294/GenDigitalInc.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1316/NBCUniversalInc.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1377/CarrefourSA.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1392/LindtSprngliAG.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1500/GlanbiaPlc.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1505/TelenorGroup.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1506/TiffanyCo.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1507/SonocoProductsCompany.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/2222/TheEsteeLauderCompaniesInc.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/547/GlaxoSmithKlinePLC.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/551/PhilipsNV.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/557/RocheDiagnosticsLtd.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/582/AbbottLaboratoriesLtd.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/611/BostonConsultingGroup.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/614/SamsungElectronicsCoLtd.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/653/HoneywellInternationalInc.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/676/CiscoSystemsInc.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/732/ProcterGambleCo.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/777/DuPontCompany.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/788/VolvoCarCorporation.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/791/GoogleInc.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/798/GoodyearTireRubberCompany.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/819/HexcelCorporation.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/841/WesternUnionCompany.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/853/DHLInternationalGmbH.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/901/UnileverNV.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/941/MicrosoftCorporation.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/952/GroupeDanone.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/975/BayerAG.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/favicon.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/header-sprite.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/home/home-hero-bg.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/icon-nav-sprite-4.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/logo.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/our-services-icons/icon-conferences-and-training.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/our-services-icons/icon-consultancy.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/our-services-icons/icon-custom-research.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/our-services-icons/icon-market-research-store.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/our-services-icons/icon-subscriptions.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-bbc.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-bloomberg.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-business-insider.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-cnn.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-forbes.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-reuters.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-the-economist.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-the-new-york-times.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-the-wall-street-journal.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-the-washington-post.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-time-magazine.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/reviews/logo-usa-today.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/product_images/11761/11761448_115px_jpg/royalty_rates_in_pharmaceutical_and_biotechnology_licensing_deals.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/product_images/12006/12006524_115px_jpg/artificial_intelligence_market.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/product_images/12128/12128713_115px_jpg/hvac_market.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/product_images/12189/12189942_115px_jpg/global_mining_directory.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/product_images/12487/12487885_115px_jpg/coffee_market.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.reuters.com/markets/us/solana-ventures-forte-griffin-invest-150-million-blockchain-gaming-2021-12-14</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.washingtonpost.com/wellness/2022/01/11/are-detox-juice-cleanses-necessary</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.wsj.com/articles/google-aims-for-commercial-grade-quantum-computer-by-2029-11621359156</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/?subject=unsubscribe&amp;dt=Research</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/?subject=unsubscribe&amp;r=&amp;lt=330&amp;evt=pageLoad&amp;sv=2&amp;asc=D&amp;cdb=AQAY&amp;rn=547775</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/?subject=unsubscribe&amp;scrsrc=www.googletagmanager.com&amp;rnd=354609279.1791199268&amp;navt=n&amp;npa=1&amp;_tu=CA&amp;gtm=45be69u2h1v9178959160z876435191za20gzb76435191zd76435191xeaxf1&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938465~115938469~117776796~118897920~118897930~120213116~120385423~120469145~120469153~121046262~121046270~121246027~121246035~121280971&amp;tft=1791199267956&amp;tfd=699&amp;tids=AW-1070844149&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/?subject=unsubscribe&amp;scrsrc=www.googletagmanager.com&amp;rnd=354609279.1791199268&amp;navt=n&amp;npa=1&amp;ep.ads_data_redaction=0&amp;gtm=45He69u2h1v76435191za200zd76435191xeaxf1&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938465~115938468~117776796~118897920~118897930~120385423~120469145~120469153~121280971&amp;tft=1791199267730&amp;tfd=472&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://edition.cnn.com/2021/11/02/tech/foodmarble-aire-hydrogen-breath-test-spc-intl/index.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://eu.usatoday.com/story/travel/news/2021/12/11/active-vacations-bike-hike-paddle-cook-bucket-list-locations/6421695001</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ie.linkedin.com/company/research-and-markets</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a-/ALV-UjUEXKD7awfUKeS8jqnKOaTwFKzu1CMU--BOU0mKoggFtQ=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a-/ALV-UjUIzrBIJ6RRs3Hwp34xvlTIOUBdwvTjqLAh2TEJgcjCwuEGjwsGBA=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a-/ALV-UjUlia_AX1_YRGxNBJVvPL7RESHyxscu6SjaRHtLpwBW-qyY4bjL=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a-/ALV-UjVyXUtJ3J6F5sG5olAxXdYcdbs2XGiEHgHQXfs9qaxD7hHffVgO=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a-/ALV-UjW68KuP7divAnm-7wNa64jg2mqLlt5zxSbis42J2Cb3LcRddYrnwg=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a-/ALV-UjXRZ7PWQOYZ5fh-gkIrY4rGsItv0VIbxoy-lthJOyWzv0ST8nXd=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a-/ALV-UjX_3eB0TySIDdDszL-sx8m9BmK8FLvEDMuxaGf3FOhq4T8egNjE3w=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocI21caDrWiA1GIZRrG4ADMdg8X1YBu5rf4TUTjQh5ED7gKfeA=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocIURKT3ruZn2EWFl8SKSTvEbinCu_25NLHArBw6fTTMtD3Q7g=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocIXVD9WqoxU6SRS1BkOyY4TyVi-nLR6Tefd_uKrFgZrpt48bw=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocIlUU96dyn5C3o-6zjP_673WWpXYXe1Ncp9eNjBmQmb8z_88A=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocIt1qWerm-59DfHX3LpieaS-s0_IfTYYoUUQs3EXLZbcinO=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocIxin2CabJfATEHUctjrLcDZr-MAW3LVmgLdHVJ_gc0T6Ma7w=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocJktsZP_gqJtnzFA1juzjURRd1VFpcwcfhfmkip8Jrf6Iww7g=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocJxOkNkDOEFi7sPQhx7055YuFPp-acWe9RVFNArbpYxZrmkXA=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocKqFK8mWfV8FZxzUJWLHDRX6_Hasdp2IapiXuIaVhUHPMqm7w=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocL0-QAvbI7yrG_YPW7i1SdIR-jBDlTGIhlCYfd8f-UWgV_7ew=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocL2wo8C4O0dol7ZH3VIV1_YEzFvs-jrrSWFBOYGeP-WGCgEFQ=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocLM0B3tTxwxEGv4rSs4V6JO2t4P47nGNLj7WzccSXGKFQzPiA=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocLOk_wP1wb1EFg221GuknuK8EycI599n7pfeR-Ofve9hO4wdA=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocLOmRbfPeAuv81GzNFQ9yCX0HGTdSCCfPHSCzVl7Hhd3lVEGg=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocLQPkyDrjQ2rtZ9NugaYUp10ZmAbqthWOjDwC_VdfTIoqIMdg=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/ACg8ocLslcmyJQnZv2AblxSRWJwJ3CwTAlro9UM8LnNW_AIWFOPITg=s120-c-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/AEdFTp4DLHO9UI85f7wC_CSa6wUgxjr43dRoNX0bqTMg=s120-c-c0x00000000-cc-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/AEdFTp4SUSIGewOhwgjGk-4jETBCnlWemJcBVv6JQdBv=s120-c-c0x00000000-cc-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/AEdFTp4Wnhaj4c2crsMPkLwxdZWfD3_ULaT3iDpn3L1o=s120-c-c0x00000000-cc-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/AEdFTp60KhubPZJSZd-zjkyx4l58uvdFucH23E6Aa2KN=s120-c-c0x00000000-cc-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/AEdFTp74ClIxsYkJbv26iwlMurX3xHF9Ics9GI06rrze=s120-c-c0x00000000-cc-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/AGNmyxYk4JIFECmbljBg27zXGuM3a9fUEaOixXu_o7nm=s120-c-c0x00000000-cc-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/a/AGNmyxaZJGYqK-qJL6uMTor7by9kJgBenCYE-hVoQ0lk=s120-c-c0x00000000-cc-rp-mo-br100</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://publishers.researchandmarkets.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://time.com/6131320/digital-twins-uses</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://twitter.com/researchmarkets</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.bbc.com/news/business-56320899</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.bloomberg.com/press-releases/2021-12-03/ovation-science-provides-an-update-on-its-topical-cannabis-research-and-development-efforts-kwqe9vzv</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.economist.com/business/2022/03/26/botox-and-other-injectable-cosmetics-are-booming</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.forbes.com/sites/greatspeculations/2022/03/28/dominos-pizza-delivering-a-superior-business-model/?sh=27a548cf2042</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=GTM-KPC7CQN</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/ns.html?id=GTM-KPC7CQN</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.insiderintelligence.com/insights/remote-patient-monitoring-companies-startups</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/research-and-markets</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.nytimes.com/2021/05/11/business/covid-weight-loss-companies.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/logo.png</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/search.asp?q=%7Bsearch_term_string%7D</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.reuters.com/markets/us/solana-ventures-forte-griffin-invest-150-million-blockchain-gaming-2021-12-14</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.washingtonpost.com/wellness/2022/01/11/are-detox-juice-cleanses-necessary</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.wsj.com/articles/google-aims-for-commercial-grade-quantum-computer-by-2029-11621359156</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>ad.doubleclick.net</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>bat.bing.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>bat.bing.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>edition.cnn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>eu.usatoday.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>publishers.researchandmarkets.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>region1.analytics.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>stats.g.doubleclick.net</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>time.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>twitter.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>www.bbc.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.bloomberg.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.forbes.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.de</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.insiderintelligence.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.nytimes.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.researchandmarkets.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.reuters.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.washingtonpost.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.wsj.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>edition.cnn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>eu.usatoday.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>ie.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>lh3.googleusercontent.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>publishers.researchandmarkets.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>time.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>twitter.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>www.bbc.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.bloomberg.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.economist.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.forbes.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.insiderintelligence.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.nytimes.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.researchandmarkets.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.reuters.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.washingtonpost.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.wsj.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>company-message-bg@2x.jpg</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>your@email.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>146.75.121.73</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>142.251.110.148</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.156</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.14.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.150.119</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>146.75.122.49</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>150.171.27.10</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>150.171.30.10</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>216.239.32.36</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.14.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>142.251.14.132</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>162.159.140.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>146.75.121.164</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>146.75.122.62</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>34.225.248.224</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>151.101.67.5</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>146.75.122.49</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>142.251.14.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>142.251.13.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>20.50.2.62</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>13.33.187.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.18.41.41</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>146.75.120.81</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.18.42.19</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>146.75.121.55</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>151.101.67.52</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>23.67.138.91</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>439b18ce13f70e895f5c2e07c70d1b3424c8597432985a982b7c5d19795dfb6b</SHA-256>
              <SHA-1>a1c1f7bdb5a47f3509488d34b50123f940fbf1a7</SHA-1>
              <MD5>93c194e773c9fa345c8a234880192585</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>0315faf29c8c1591c7fab355261e857da47215122672a7a5ca074b90b88434f8</SHA-256>
              <SHA-1>49bfd981dc6073581151407449b3c3270b9f2b72</SHA-1>
              <MD5>0eba4493fdf9d185899b323a49235de8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>58c1583be6a3b7c9edda1b065a32b4cfe9330894da070e8fbcfc2ad8ea5a37e0</SHA-256>
              <SHA-1>52f0139caeb314f9d003d84c2e044fb61a1557a9</SHA-1>
              <MD5>c3226f96ab2105e0ba4f475c236d8261</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>b33acc76296910e3df619bb8615d2c248b3dda91adf55de8bc4a52d48cb76441</SHA-256>
              <SHA-1>2de5b2acff820db3b6e9bd25beea6143c2184eb6</SHA-1>
              <MD5>e1252487dd6222f2f39b801bdafe891e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>329cf248f43935907f26b5f67cd483cf47674efd367e63bacdf08c49d54416e5</SHA-256>
              <SHA-1>ec8626aa01fbfd43b9ee2fcf8747ed27f025734c</SHA-1>
              <MD5>f34af926da841862be7e21b5e0076dd5</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>824daa32f45e7640de3a88703a78b5818a17a441c69d0f183db0ffa8815650b0</SHA-256>
              <SHA-1>9d136583905c07e86fdffdb59851f7a293167292</SHA-1>
              <MD5>2b24209f823512728089e461233d1d81</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>263ff8cfbeb24b91f038f5933a6c2678b4622b4269b25d955bf75a9f29b26d93</SHA-256>
              <SHA-1>e1cd9025da5a930828393dd3cf38c4bda68903ca</SHA-1>
              <MD5>4f2c826383fa530c36ad9731aab7a5c6</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>32baaf6043e32c4cce8ce87489859f356ebe632d9fc733d70b35b1de5ceeaa78</SHA-256>
              <SHA-1>7f1ed5fbfcaab371daaae1c64a43a1b15ab9566a</SHA-1>
              <MD5>feeab7e6ef45c4cea5747dcd5ad729ba</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>bb0aa3200cb69f408c9c36fedd3c2fddf994757f73e1dd4be005ed3b462a5fe1</SHA-256>
              <SHA-1>2bff050f2bb29bb98510eea253678b303885acf3</SHA-1>
              <MD5>8d96bfccc482989eec81b088234cdaa2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>20151fdc5d6a2d2b7c61fed35af33f29b77d54a0e21f5dddb5f7485b84ff8046</SHA-256>
              <SHA-1>6d3cd97d5175478692b55636d18b214e964c3c97</SHA-1>
              <MD5>6305f19770a321df9b78b1d29a8878da</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://www.researchandmarkets.com/?subject=unsubscribe</name>
        <report_id>b201cb86-b32c-4cd5-bc10-ba34873a705c</report_id>
        <tags>
          <value>html</value>
          <value>png</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>da0d33b20e87d0ac3343c630e725b35191fa24a48c49249ff476ae43c57e73ee</id>
    <title>Analysis Report for da0d33b20e87d0ac3343c630e725b35191fa24a48c49249ff476ae43c57e73ee</title>
    <updated>2026-10-05T11:21:04Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3887189017dd18dc1bea7</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac3882036412e623d2c857f</flow_id>
        <hash>da0d33b20e87d0ac3343c630e725b35191fa24a48c49249ff476ae43c57e73ee</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://ad.doubleclick.net/ccm/s/collect?auid=1813087012.1791199297&amp;gtm=45He69u2v76435191za200zd76435191xeaxf1&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.com/bat.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.com/p/action/5439471.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.net/action/0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.net/action/0?ti=5439471&amp;tm=gtm002&amp;Ver=2&amp;mid=b36f716c-3a11-423f-9c01-acd43121def6&amp;bo=2&amp;pi=918639831&amp;lg=en-US&amp;sw=800&amp;sh=600&amp;sc=24&amp;nwd=1&amp;tl=Wireless%20Network%20Security%20Market%20Size%20%26%20Competitors&amp;p=https%3A%2F%2Fwww.researchandmarkets.com%2Freport%2Fglobal-wireless-network-security-market%3Frmtoken%3Dnzr4idpwg&amp;r=&amp;lt=240&amp;evt=pageLoad&amp;sv=2&amp;asc=D&amp;cdb=AQAY&amp;rn=325304</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.net/actionp/0?ti=5439471&amp;tm=gtm002&amp;Ver=2&amp;mid=b36f716c-3a11-423f-9c01-acd43121def6&amp;bo=1&amp;evt=consent&amp;src=enforced&amp;cdb=AQAY&amp;asc=D</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://publishers.researchandmarkets.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.analytics.google.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.analytics.google.com/g/collect?v=2&amp;tid=G-HER5SHVQ13&amp;gtm=45je69u2v889702130z876435191za20gzb76435191zd76435191xf1&amp;_p=1791199297204&amp;_gaz=1&amp;gcd=13l3l3l2l1l1&amp;npa=1&amp;dma_cps=a&amp;dma=1&amp;_eu=EAAAACAC&amp;are=1&amp;cid=1585107876.1791199297&amp;frm=0&amp;ibt=1&amp;ir=1&amp;ngs=1&amp;pscdl=noapi&amp;rcb=9&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;_s=1&amp;tag_exp=115616985~115938465~115938468~118897920~118897930~120213116~120385422~120412528~120469145~120469153~121280969&amp;cu=EUR&amp;sid=1791199297&amp;sct=1&amp;seg=0&amp;dl=https%3A%2F%2Fwww.researchandmarkets.com%2Freport%2Fglobal-wireless-network-security-market%3Frmtoken%3Dnzr4idpwg&amp;dt=Wireless%20Network%20Security%20Market%20Size%20%26%20Competitors&amp;tfd=597</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://stats.g.doubleclick.net/g/collect?v=2&amp;ngs=1&amp;ibt=1&amp;tid=G-HER5SHVQ13&amp;cid=1585107876.1791199297&amp;gtm=45je69u2v889702130z876435191za20gzb76435191zd76435191xf1&amp;rcb=9&amp;aip=1&amp;dma=1&amp;dma_cps=a&amp;gcd=13l3l3l2l1l1&amp;npa=1&amp;frm=0&amp;tag_exp=115616985~115938465~115938468~118897920~118897930~120213116~120385422~120412528~120469145~120469153~121280969</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://twitter.com/researchmarkets</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect?rcb=12&amp;frm=0&amp;apvc=1&amp;ae=g&amp;auid=1813087012.1791199297&amp;dt=Wireless%20Network%20Security%20Market%20Size%20%26%20Competitors&amp;en=page_view&amp;dl=https%3A%2F%2Fwww.researchandmarkets.com%2Freport%2Fglobal-wireless-network-security-market%3Frmtoken%3Dnzr4idpwg&amp;scrsrc=www.googletagmanager.com&amp;rnd=488335620.1791199297&amp;navt=n&amp;npa=1&amp;ep.ads_data_redaction=0&amp;gtm=45He69u2v76435191za200zd76435191xeaxf1&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938465~115938468~118897920~118897930~120385423~120469145~120469153~121280969&amp;tft=1791199297243&amp;tfd=399&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect?rcb=9&amp;frm=0&amp;apvc=0&amp;ae=g&amp;auid=1813087012.1791199297&amp;dt=Wireless%20Network%20Security%20Market%20Size%20%26%20Competitors&amp;tid=AW-1070844149&amp;dl=https%3A%2F%2Fwww.researchandmarkets.com%2Freport%2Fglobal-wireless-network-security-market%3Frmtoken%3Dnzr4idpwg&amp;scrsrc=www.googletagmanager.com&amp;rnd=488335620.1791199297&amp;navt=n&amp;npa=1&amp;_tu=CA&amp;gtm=45be69u2v9178959160z876435191za20gzb76435191zd76435191xeaxf1&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616986~115938465~115938469~118897920~118897930~120213116~120385423~120469145~120469153~121280969&amp;tft=1791199297557&amp;tfd=713&amp;tids=AW-1070844149&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/recaptcha/api.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/recaptcha/api2/anchor?ar=1&amp;k=6LcBhQ0TAAAAAOmh38lyXycRM8dSxKt4SDyO2mu4&amp;co=aHR0cHM6Ly93d3cucmVzZWFyY2hhbmRtYXJrZXRzLmNvbTo0NDM.&amp;hl=en&amp;v=guXhH0v-XMxlzmbTwqkaT4i5&amp;size=normal&amp;anchor-ms=20000&amp;execute-ms=30000&amp;cb=h3v96zrfeo9l</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/recaptcha/api2/bframe?hl=en&amp;v=guXhH0v-XMxlzmbTwqkaT4i5&amp;k=6LcBhQ0TAAAAAOmh38lyXycRM8dSxKt4SDyO2mu4&amp;bft=0dAFcWeA7LxhtOIbKaONK2iUpUz3Z0v32yn5_fcsJIhSI_5iUi3Qgc61FEat8jEcX7TIKXRNqhNepI9fgy6ZGOWP3FS3Lu0Opp2Q</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.de/ads/ga-audiences?v=1&amp;t=sr&amp;slf_rd=1&amp;_r=4&amp;ngs=1&amp;ibt=1&amp;tid=G-HER5SHVQ13&amp;cid=1585107876.1791199297&amp;gtm=45je69u2v889702130z876435191za20gzb76435191zd76435191xf1&amp;rcb=9&amp;aip=1&amp;dma=1&amp;dma_cps=a&amp;gcd=13l3l3l2l1l1&amp;npa=1&amp;frm=0&amp;tag_exp=115616985~115938465~115938468~118897920~118897930~120213116~120385422~120412528~120469145~120469153~121280969&amp;z=1249780523</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/destination?id=AW-1070844149&amp;cx=c&amp;gtm=4e69u2</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/destination?id=G-HER5SHVQ13&amp;cx=c&amp;gtm=4e69u2</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-HER5SHVQ13&amp;cx=c&amp;gtm=4e69u2</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=GTM-KPC7CQN</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/recaptcha/releases/guXhH0v-XMxlzmbTwqkaT4i5/recaptcha__en.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/research-and-markets</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Common/ExchangeRates</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Common/GoogleReviews</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Common/LogHttpRequest</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/KFOlCnqEu92Fr1MmEU9fBBc4.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/KFOlCnqEu92Fr1MmSU5fBBc4.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/KFOlCnqEu92Fr1MmWUlfBBc4.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/KFOlCnqEu92Fr1MmYUtfBBc4.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/KFOmCnqEu92Fr1Mu4mxK.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/fontawesome-webfont.woff</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/fontawesome-webfont.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Fonts/icomoon.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Home/IsEaa</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Home/SetCountryCodeCookie</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Styles/font-awesome-4.0.3-custom.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Styles/fonts-googleapis-com-20-roboto-custom.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/Styles/v-639233295300000000/ProductsCore.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/bundles/views/v-639233295320000000/productPages.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/bundles/views/v-639233295320000000/productPagesNonCritical.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/bundles/views/v-639233295340000000/js-core.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1047/NagraKudelskiGroup.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1253/RTXCorporation.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1294/GenDigitalInc.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/1295/VisonicGroup.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/676/CiscoSystemsInc.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/company_logos/948/DELLEMC.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/favicon.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/google-logo.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/header-sprite.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/icon-nav-sprite-4.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/logo.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/our-services-icons/icon-conferences-and-training.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/our-services-icons/icon-consultancy.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/our-services-icons/icon-custom-research.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/our-services-icons/icon-market-research-store.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/our-services-icons/icon-subscriptions.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/people/olha-vdovychenko-min.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/images/sprite-offer.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/product_images/12737/12737037_115px_jpg/wireless_network_security_market.jpg?width=230</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg#1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg#2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg#3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg#basket</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg#main-nav-content</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg#product--adaptive</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg#product--ask-question</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg#product--description</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg#product--related-products</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg#product--tags</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg#product--toc</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg#recentProducts</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg#selectFormat</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg&amp;dt=Wireless</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg&amp;r=&amp;lt=240&amp;evt=pageLoad&amp;sv=2&amp;asc=D&amp;cdb=AQAY&amp;rn=325304</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg&amp;scrsrc=www.googletagmanager.com&amp;rnd=488335620.1791199297&amp;navt=n&amp;npa=1&amp;_tu=CA&amp;gtm=45be69u2v9178959160z876435191za20gzb76435191zd76435191xeaxf1&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616986~115938465~115938469~118897920~118897930~120213116~120385423~120469145~120469153~121280969&amp;tft=1791199297557&amp;tfd=713&amp;tids=AW-1070844149&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg&amp;scrsrc=www.googletagmanager.com&amp;rnd=488335620.1791199297&amp;navt=n&amp;npa=1&amp;ep.ads_data_redaction=0&amp;gtm=45He69u2v76435191za200zd76435191xeaxf1&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938465~115938468~118897920~118897930~120385423~120469145~120469153~121280969&amp;tft=1791199297243&amp;tfd=399&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://ie.linkedin.com/company/research-and-markets</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://publishers.researchandmarkets.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://twitter.com/researchmarkets</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.google.com/recaptcha/api.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=GTM-KPC7CQN</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/ns.html?id=GTM-KPC7CQN</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/research-and-markets</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/report/global-wireless-network-security-market</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>ie.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>publishers.researchandmarkets.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>twitter.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.researchandmarkets.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ad.doubleclick.net</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>bat.bing.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>bat.bing.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>publishers.researchandmarkets.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>region1.analytics.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>stats.g.doubleclick.net</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>twitter.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.de</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.researchandmarkets.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>RMSupport@researchandmarkets.net</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>help@researchandmarkets.net</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>your@email.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>104.18.41.41</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>162.159.140.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>146.75.122.49</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.50.2.62</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.149</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.110.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.154</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.14.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.153.119</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.157.119</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>146.75.122.49</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>150.171.27.10</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>150.171.28.10</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>216.239.34.36</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>bd92a57ef16a931b4e24a99ef45e86f3ca75f5170c2ffbd4a5d3287a380a52d1</SHA-256>
              <SHA-1>d21d0374e062c4c78bef246802133046d4b70695</SHA-1>
              <MD5>a544c42aa52160491d9d9c152fafd61c</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>263ff8cfbeb24b91f038f5933a6c2678b4622b4269b25d955bf75a9f29b26d93</SHA-256>
              <SHA-1>e1cd9025da5a930828393dd3cf38c4bda68903ca</SHA-1>
              <MD5>4f2c826383fa530c36ad9731aab7a5c6</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>039c46d46e69a2674d46321f98c107867164335c64afc78021c3e93c8549ea70</SHA-256>
              <SHA-1>b20aa58b5c28e3376a9803f79849386b42d750cd</SHA-1>
              <MD5>c1a61cc5b0b3714987bf3ea91543e9c2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>c2cc6bde0a1024cf5f560d0e0b9d4b460666997f2c11617139a428cb43fa5e30</SHA-256>
              <SHA-1>e6a95c5c435098a4b93171036e37c4acab830f0a</SHA-1>
              <MD5>cf6f4a1e2887fd0583774f26b1f3c6b0</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>845a200cecd29260971ed998d7370418569815f9a4bd6a2e1b8b55ace2f7b111</SHA-256>
              <SHA-1>6059a4c3dc463881ffb192766e0df3c7a726a353</SHA-1>
              <MD5>67f13a336549c445061633b48cd98084</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>d8ce3c3f739c8c2579455b239aa4b50c760c03573a0a3bda66319e67dc3ce87c</SHA-256>
              <SHA-1>9a6bfc33a3adde6f726b03d3edd0d8f3d2f4e0a4</SHA-1>
              <MD5>ed4941319442071f4aa190ec6d97ec08</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>a7b51cc40a1c40ce73e9c21a85d35b2a54b90f20d2c1edc7f702fec2c656ea43</SHA-256>
              <SHA-1>222c7bf01552f52c740de10cd34167f2d650fe6c</SHA-1>
              <MD5>baca849a30d16dd22d8b4b5d910b6ba4</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>c469f8fecbc7f00972d1659dbe6e12b84eefeeea7fcff49d19b938d48343ff3c</SHA-256>
              <SHA-1>6eeb91510caa55ea942bb622ef28a4bf34ec8890</SHA-1>
              <MD5>da3b833863cf083acc427358c8bdbed6</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>37d41d94b564c2f055340a355a1fa945b818849966ad0ebc779ada09c63ebaa7</SHA-256>
              <SHA-1>8145c2058139c1b9a74d4c1f97f4beb8fd2b42fe</SHA-1>
              <MD5>7aabd73f0c7565b683fb25952619f742</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>88df798f15f12cb328235f35fa15b391d89d1d7b6a028b2901f99815497aeff2</SHA-256>
              <SHA-1>88c4f13b8294c5c60d15aed85e263c2ed01c5f12</SHA-1>
              <MD5>e9d16e3ad83e2ac837274906eb0df03f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://www.researchandmarkets.com/report/global-wireless-network-security-market?rmtoken=nzr4idpwg</name>
        <report_id>04f51fe3-55cf-4b57-afa2-9d5fa470da09</report_id>
        <tags>
          <value>html</value>
          <value>javascript</value>
          <value>obfuscated</value>
          <value>captcha</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f78ef394f265dbfb65457158ed69c471895b1ce6ef9ece1af96be10e3f7ddce4</id>
    <title>Analysis Report for f78ef394f265dbfb65457158ed69c471895b1ce6ef9ece1af96be10e3f7ddce4</title>
    <updated>2026-10-05T11:19:44Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac387f1d130e7ad45267406</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6ac387cededbc9646d41b067</flow_id>
        <hash>f78ef394f265dbfb65457158ed69c471895b1ce6ef9ece1af96be10e3f7ddce4</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.researchandmarkets.com/cancel?rmtoken=nz</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.opswat.com/solutions/email-security&amp;amp;data=05</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/unsubscribe?rmtoken=nzr4idpwg&amp;amp;data=05</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>opswat.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.opswat.com%2Fsolutions%2Femail-security&amp;amp;data=05%7C02%7Ctim.wikander%40opswat.com%7Ce9787aa176c14473d67c08df228113d3%7C58122277edf8404896c4ec80d30669b8%7C0%7C0%7C639267610957470354%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&amp;amp;sdata=REjH1c%2F%2Fa6MM7I8EPACXCO7Ek62RUqwN70wn6IpigWo%3D&amp;amp;reserved=0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.researchandmarkets.com%2Funsubscribe%3Frmtoken%3Dnzr4idpwg&amp;amp;data=05%7C02%7Ctim.wikander%40opswat.com%7Ce9787aa176c14473d67c08df228113d3%7C58122277edf8404896c4ec80d30669b8%7C0%7C0%7C639267610957442228%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&amp;amp;sdata=VLBQpdxr84cceK88xNpyoapdmsADBdUx390LEdA1Qlo%3D&amp;amp;reserved=0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://tracking.researchandmarkets.com/MailCampaigns/-1691371899.png</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://www.opswat.com/solutions/email-security</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/reports/6055533/wireless-network-security-market-global?rmtoken=nzr4idpwg</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>file:///tmp/tmp25rpvz59.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/?url=</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/cancel?rmtoken=nzr4idpwg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:lorraine.allen%40researchandmarkets.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:researchandmarkets.com%40mg3.researchandmarkets.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:tim.wikander%40opswat.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.opswat.com%2Fsolutions%2Femail-security&amp;amp;data=05%7C02%7Ctim.wikander%40opswat.com%7Ce9787aa176c14473d67c08df228113d3%7C58122277edf8404896c4ec80d30669b8%7C0%7C0%7C639267610957470354%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&amp;amp;sdata=REjH1c%2F%2Fa6MM7I8EPACXCO7Ek62RUqwN70wn6IpigWo%3D&amp;amp;reserved=0</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.researchandmarkets.com%2Freports%2F6055533%2Fwireless-network-security-market-global%3Frmtoken%3Dnzr4idpwg&amp;amp;data=05%7C02%7Ctim.wikander%40opswat.com%7Ce9787aa176c14473d67c08df228113d3%7C58122277edf8404896c4ec80d30669b8%7C0%7C0%7C639267610957407695%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&amp;amp;sdata=aEg8ASfRAKOVnZng45rpsRgk71K3ej0JVuSiPcOI3Oo%3D&amp;amp;reserved=0</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.researchandmarkets.com%2Funsubscribe%3Frmtoken%3Dnzr4idpwg&amp;amp;data=05%7C02%7Ctim.wikander%40opswat.com%7Ce9787aa176c14473d67c08df228113d3%7C58122277edf8404896c4ec80d30669b8%7C0%7C0%7C639267610957442228%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&amp;amp;sdata=VLBQpdxr84cceK88xNpyoapdmsADBdUx390LEdA1Qlo%3D&amp;amp;reserved=0</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://tracking.researchandmarkets.com/MailCampaigns/-1691371899.png</url>
              <origin>EMAIL_BODY</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://www.opswat.com/solutions/email-security</url>
              <origin>EMAIL_BODY</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/reports/6055533/wireless-network-security-market-global?rmtoken=nzr4idpwg</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/unsubscribe?rmtoken=nzr4idpwg</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.opswat.com/solutions/email-security&amp;amp;data=05</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/reports/6055533/wireless-network-security-market-global?rmtoken=nzr4idpwg&amp;amp;data=05</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.researchandmarkets.com/unsubscribe?rmtoken=nzr4idpwg&amp;amp;data=05</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>opswat.com</url>
              <origin>EMAIL_BODY</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>nam04.safelinks.protection.outlook.com</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>opswat.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>researchandmarkets.com</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>tracking.researchandmarkets.com</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>nam04.safelinks.protection.outlook.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.researchandmarkets.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>researchandmarkets.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>nam04.safelinks.protection.outlook.com</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>opswat.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>researchandmarkets.com</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>tracking.researchandmarkets.com</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>20261005013555.5380c8488bd3b893@mg3.researchandmarkets.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>lorraine.allen@researchandmarkets.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>opswat.com@mg3.researchandmarkets.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>researchandmarkets.com@mg3.researchandmarkets.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>tim.wikander@opswat.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>10.1.24.53</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>10.167.247.117</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>10.167.249.232</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>161.38.204.236</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>20.67.217.70</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>54.69.214.246</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>20.107.224.57</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>3.173.0.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>52.102.113.68</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>caef5e87db265ea65e20bff1d3f44f2527caf27ba6ac952d2cdc6f37db5c6a42</SHA-256>
              <SHA-1>06a0aeae516c116a5ef4b0e75bba49fa5bc03f4a</SHA-1>
              <MD5>8de69db66bb9168e3541917ea4437823</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>application/xhtml+xml</file_type>
            </value>
            <value>
              <SHA-256>1618bd6fff41a2f53a60aa121c72733d934ac13be7ba72d035d7fc52ab096d51</SHA-256>
              <SHA-1>dff0ecdba5e46bd95af818c06b03b8f91007a22c</SHA-1>
              <MD5>88746025a3589befab492f388e5f7e17</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>5d55e5f36905a8c753ce67de14930f4f1738ca72da4ff9f96465367022e8c524</SHA-256>
              <SHA-1>4c9fdd6ed44179a929b3d887ccf0fd4863f66941</SHA-1>
              <MD5>5e44e4989161faf42feb501ec97a2782</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>0a4783979c55c54467d0617ab8a17389b5f08ff09f8f21a3500f34237f23156b</SHA-256>
              <SHA-1>526dd5d5c34adebdbef5b78001bff736748e41b3</SHA-1>
              <MD5>bf7ddc3a3bf34172fe2af39142c4c2e1</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>7c41b898c5da0cfa4aa049b65ef50248bce9a72d24bef4c723786431921b75aa</SHA-256>
              <SHA-1>10588307553e766ab3c7d328d948dc6754893cef</SHA-1>
              <MD5>825644f747baab2c00e420dbbc39e4b3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>f8e848b5b0ca2b752709c65d73b6f54785740165983fb8dd5a8e05f4961a6721</SHA-256>
              <SHA-1>5e2f9a21e5328f8fb9a85845504159588a1c3d82</SHA-1>
              <MD5>a09974053e21d30371ca3f3c1c2f0970</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>f809dae7b8ee0f4152d293c09c5d4d4fae874bf7bbca7424a015cdc6bfba8501</SHA-256>
              <SHA-1>e830828998a692a5f648f1300fe9fba4137cf62f</SHA-1>
              <MD5>5059b6f004750c4b8eaaeec05beded66</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>da0d33b20e87d0ac3343c630e725b35191fa24a48c49249ff476ae43c57e73ee</SHA-256>
              <SHA-1>511ec6d323e3354c49822f22940a49ac64fa1e07</SHA-1>
              <MD5>b065c6715c9ea916f56c38614114cd69</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>2deb6c93-f9c2-4e8d-3e9c-08df228100d1</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>58122277-edf8-4048-96c4-ec80d30669b8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e9787aa1-76c1-4473-d67c-08df228113d3</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>Wireless Network Security Market 20262032 Global Forecast and Growth Outlook.eml</name>
        <report_id>d08f6bc2-34b0-42cb-bb3e-ec6c15feb90c</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
          <value>xml</value>
          <value>png</value>
          <value>html</value>
          <value>txt</value>
          <value>captcha</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d68c55a18ccc1d12cc38f282061a5a66d62e00f70be4f480751d98e35a3abdcc</id>
    <title>Analysis Report for d68c55a18ccc1d12cc38f282061a5a66d62e00f70be4f480751d98e35a3abdcc</title>
    <updated>2026-10-05T11:19:43Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac387e9d130e7ad45267403</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6ac387cededbc9646d41b069</flow_id>
        <hash>d68c55a18ccc1d12cc38f282061a5a66d62e00f70be4f480751d98e35a3abdcc</hash>
        <iocs>
          <urls>
            <value>
              <url>https://docs.google.com/drawings/d/1DYi2YdEOvXQiHlaa1Ar9oA70gOggivL</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1Xj3Ymz8UIut4jiBAAjXbuShALxccz4s</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1nEZMfeYFlvgTljFSBm5FOVfN-zAkJGl</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>file:///tmp/tmphjq1w5mr.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/11CobCS3OhiRJWoF1oJeBtU8MyIKvXlLwnDYx7QO8g28/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1DYi2YdEOvXQiHlaa1Ar9oA70gOggivLAa9q8WDjM8mM/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1Xj3Ymz8UIut4jiBAAjXbuShALxccz4st7rafAmmlNX0/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1nEZMfeYFlvgTljFSBm5FOVfN-zAkJGlVZW88nBjTafM/preview</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/11CobCS3OhiRJWoF1oJeBtU8MyIKvXlLwnDYx7QO8g28/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1DYi2YdEOvXQiHlaa1Ar9oA70gOggivLAa9q8WDjM8mM/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1Xj3Ymz8UIut4jiBAAjXbuShALxccz4st7rafAmmlNX0/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/drawings/d/1nEZMfeYFlvgTljFSBm5FOVfN-zAkJGlVZW88nBjTafM/preview</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>docs.google.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>docs.google.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>docs.google.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.110.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>09efde80bae251a9dd3aad531b57332320a6b4ed01e35a60d33786b805dfba30</SHA-256>
              <SHA-1>7bb1b42352be2c14cace4c0eebb09d1644eb7e12</SHA-1>
              <MD5>83240d86805b408bee8049c1f4a79140</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/html</file_type>
            </value>
            <value>
              <SHA-256>da5b3f350974b747c8ee4d71f8a4f51f00dcbf310ce908180badc52408206c25</SHA-256>
              <SHA-1>95f242514b8b2e9f6e1c767022480323c492e045</SHA-1>
              <MD5>f1d295a504b22605bd4917ff74206f9f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>d35699b992f7dad3596ccf51583a5a421d93c2badcde422eac058e4a29615f45</SHA-256>
              <SHA-1>a9be293e393aaf65f648fbe161b97968480788df</SHA-1>
              <MD5>ffd747c83cd96736575d97d3ca7ae305</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>f1967b8b88279faea9f42e45b366238991bf090d14d8370e60297a69181dd81a</SHA-256>
              <SHA-1>19bb5055d6b8ad740870815d9b916abaedd7efe4</SHA-1>
              <MD5>618e351fbee66077f671b5e8cc494e12</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>1f0dc84ecb212577d31e8d1573cf154e1c8a2158b129453ec02286d8c35f7af9</SHA-256>
              <SHA-1>e101267bf5514fc9957f2888cb79af5da9daaddf</SHA-1>
              <MD5>ae00dd878686e25f0323e79e4df68457</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>8870d25956957f3d6bbe8c7bbda636ab566f04bd772d192dc1c7810996f6a26f</SHA-256>
              <SHA-1>7d55fe8a0c91208f6f615cc6cd852670b1d14a83</SHA-1>
              <MD5>514610bf055add2a32b2f9112c70f9ad</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>0daaebf95478d09e15185ecd957f7156027b196152b64ba927574b124c82cd14</SHA-256>
              <SHA-1>3ffa817f7e44975895c43c3b09a605cb4b28d199</SHA-1>
              <MD5>ab619414b30a7a11b783538396d4e2c8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>e685e99582d0090ce3c6c860f4e3da97fceb723dd728ec72031d99f790e09b2c</SHA-256>
              <SHA-1>6b3846656f1e17e1bc26d011e5435418b03eed8c</SHA-1>
              <MD5>df2167db6edf27a33a2493513e0ed03f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </files>
        </iocs>
        <name>submission.eml</name>
        <report_id>a884c540-fec7-4cc2-afe8-1a6999b532b2</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9a441a3b1c8da58b30543d91e1cb82bb8609a0f60b4c942d2696c23b9748863a</id>
    <title>Analysis Report for 9a441a3b1c8da58b30543d91e1cb82bb8609a0f60b4c942d2696c23b9748863a</title>
    <updated>2026-10-05T11:18:13Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3877bd130e7ad452673ef</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6ac38774dedbc9646d41af71</flow_id>
        <hash>9a441a3b1c8da58b30543d91e1cb82bb8609a0f60b4c942d2696c23b9748863a</hash>
        <iocs/>
        <name>9a441a3b1c8da58b30543d91e1cb82bb8609a0f60b4c942d2696c23b9748863a.elf</name>
        <report_id>57b99fd8-deed-4a5a-b5d0-a8fde39f0d67</report_id>
        <tags>
          <value>elf</value>
          <value>rust</value>
        </tags>
        <verdict>UNKNOWN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>099b16f376b6775de7ffb313b72080d865d9b706b4386bab6a024bc441bd81a4</id>
    <title>Analysis Report for 099b16f376b6775de7ffb313b72080d865d9b706b4386bab6a024bc441bd81a4</title>
    <updated>2026-10-05T11:17:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38765d130e7ad452673eb</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac38745cd19289b120c3128</flow_id>
        <hash>099b16f376b6775de7ffb313b72080d865d9b706b4386bab6a024bc441bd81a4</hash>
        <iocs>
          <urls>
            <value>
              <url>http://crl.comodoca.com/AAACertificateServices.crl04</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl.sectigo.com/SectigoPublicCodeSigningCAE36.crl0y</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl.sectigo.com/SectigoPublicCodeSigningRootE46.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl.sectigo.com/SectigoPublicTimeStampingCAR41.crl0z</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl05</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crt.sectigo.com/SectigoPublicCodeSigningCAE36.crt0#</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crt.sectigo.com/SectigoPublicCodeSigningRootE46.p7c0#</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crt.sectigo.com/SectigoPublicTimeStampingCAR41.crt0#</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/SMI/2005/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://sectigo.com/CPS0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://sectigo.com/CPS0J</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.ghisler.com</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>crl.comodoca.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crl.sectigo.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crl.usertrust.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crt.sectigo.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>ghisler.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>sectigo.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>support@ghisler.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>support@ghisler.com0</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>5.1.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.38.233</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>91.199.212.90</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>168.235.88.148</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>08602dd92a662b994289e7d584faa6b1ffe1d835640ec280a9fe4cf9dfff8213</SHA-256>
              <SHA-1>231813436d9c8e347a4464eef39ecb8b6d157eb9</SHA-1>
              <MD5>4379b474515b724d0c250b3f07af9085</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>09bd2deb8c1007dcec070cb5e2c93923729e9e51d3acc866c4252ee856d24984</SHA-256>
              <SHA-1>7fbd3e48c3fc7b3e3b9daac516622260b44c4bb5</SHA-1>
              <MD5>aeea23c50ecff2121b294566e5c50451</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>0cf55c35654d27f8a2c69bb677879fa2414f394489877d1cc4ec3d28fefa17f9</SHA-256>
              <SHA-1>a1d3febac52b59318de5b74ddced416c69758a31</SHA-1>
              <MD5>2de65306a4cb3c6764ad726658975c02</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>0fc6118386e3386e590ac0c645c43f8ca27df690a86cd32212bf7aacc4f2e853</SHA-256>
              <SHA-1>7e6fe995dbe5d2d9e01eefcead128421cfd61d75</SHA-1>
              <MD5>7eee2462e9835983bc7020d1b8953f3f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>1b002e81e808d7eeec3283de5a2833d76ea826fc05e9cf1191738b6780500093</SHA-256>
              <SHA-1>da9f8a4d396d72d8ae8f53e1ebae6a36aa394490</SHA-1>
              <MD5>b30c880110972fc16e9c8a325ef315f2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/zip</file_type>
            </value>
            <value>
              <SHA-256>2570c781cae8404572aaa4f283eb6d20f09db03d37a500d512632f1aee2124b0</SHA-256>
              <SHA-1>0c9d340ef2fe5e6d6bb39fea85585d59a6fdfeb9</SHA-1>
              <MD5>7ecb6eac9a14a0565c44f227fbc08d2a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>68d3dc62775c5b9180b8cfca367841dd7b339ae163e9ee46b6002afe7c19c2ea</SHA-256>
              <SHA-1>ab76f48d0920f8b604c876cfa0176ce154e22e61</SHA-1>
              <MD5>d890f1c0ccefd8c9efd98d257bb62843</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>9a7c6d3399b1b5c081a4410f2fbbca0eeb9846c8b6e3306d37305b3a831ac54e</SHA-256>
              <SHA-1>6442f6f1a919fa819d75004693a96f2445b834f7</SHA-1>
              <MD5>43e2bc0a1149a5470c089bac35dedf04</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>a90d86def534e245ae42d06fa2c99948648679a8865409eb0fb976d3235cd929</SHA-256>
              <SHA-1>4a83fa1dcd8f8412b3c735f0f9cbf7950bbfe2f9</SHA-1>
              <MD5>7cd9c5eb6126b8136df91b3a9da0ddcb</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>acd496a58d135236a47c29f088c5dd850421485337cc87c2f4a538d560d7ade1</SHA-256>
              <SHA-1>a85b8bbd7044b87c7ee386897c322fde38bcb580</SHA-1>
              <MD5>5ae9ed1db790d6c2ac2eb2f96490265d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>b59abc54c5ed74b3f98a10f671d5dd2487ffca16382d75778a44f03e85492a1b</SHA-256>
              <SHA-1>58e64332992799166f0d72f869bed6758430b6f6</SHA-1>
              <MD5>bbe400e3817a2f17ebcae013c7298779</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>ccbc8e935b74d8dfb1215b56f0d170cf8b739b29f2ea59987a2e279148621882</SHA-256>
              <SHA-1>061141ba74e20ed02f97033616014acce70fa794</SHA-1>
              <MD5>b5f079dc2ba3388264100a45e9683f6c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>df4956425cc01e432656045db5ffc02f1a0179d60dc8e8b51114eb987472a395</SHA-256>
              <SHA-1>a429bb12afa2d4a516b1e2e21ed0444f317867ff</SHA-1>
              <MD5>dad149d0d627da169b18a1d18361602b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>e7b46da9e9598ca1fa7339e91b385783e49fb762a8532fbb1a5cb2476e692f4e</SHA-256>
              <SHA-1>563ba89c69440dea58dedce9c0920b50d1d2b512</SHA-1>
              <MD5>6b6048caea93269d65dd0ca2a61119b8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>3b01bd8f6ec6fb51a1cb6522001d03b963142afeab03f2f2e738cb3f40f3a281</SHA-256>
              <SHA-1>4808bbb5c58dcb040e9fd574066c3803338b31af</SHA-1>
              <MD5>a216a8a2f65359961139ec88c37f7326</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/vnd.ms-cab-compressed</file_type>
            </value>
            <value>
              <SHA-256>52846612844986347b105e0d9d3d3db63cf374941f0d054c81da1ce6c1572998</SHA-256>
              <SHA-1>55d50a07a7739c4b835e39bb27756ac32b1c565e</SHA-1>
              <MD5>9d97824292ea208b01d2d3184825e436</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/x-ini</file_type>
            </value>
            <value>
              <SHA-256>52af5889151fdb11fb6b8b275c7331e63627c8e58dc12dc92c9481abf12ffcc3</SHA-256>
              <SHA-1>ca757ccd9bfe4ca3420740b544db5d73ebfd1319</SHA-1>
              <MD5>3fd66a4ba6e2421a675d73415aa187e3</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>738ed61900da95098ffdf380b9b4579387abeb3f024925cb7b9bb1464f5f2eb4</SHA-256>
              <SHA-1>d0b3a6630b6b11d4954c0a86148811e990fa4521</SHA-1>
              <MD5>8ecda9b774f045fb75b90b740d721bac</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>79023c28e61a6c5174d5e3cb84d79bd4aa99c53c53bd26f6546b6280c98335f4</SHA-256>
              <SHA-1>bddc19eb24a29ab1dfe13018390e464983d3d4f1</SHA-1>
              <MD5>67ca91f4d4841a7397e9d62add8f438c</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/x-ini</file_type>
            </value>
            <value>
              <SHA-256>92ef1449ae66e49259f444ce8a64e94dfd6e1c9d1af6801385fb48cda9e83ab3</SHA-256>
              <SHA-1>8522ecac4fa81914a4b30b193d97f82d03476156</SHA-1>
              <MD5>e9f72b8f8596cd8c354664fbedfd3484</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>9c6d3ac198dd73236554aba3e9057be0262ca1a8af531da65ae4b28f875615fe</SHA-256>
              <SHA-1>c3ba9127e513defe2cf037a1c4723d20e56ad3cd</SHA-1>
              <MD5>d0cc3f32043b86a5e697f9ef0441316b</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>ca188439c9f7548214c9fe5743f3785fae4a3fd26e841f37818271393bc92bd6</SHA-256>
              <SHA-1>b13924bf112cb412f6db12c243ea6ed752bf5241</SHA-1>
              <MD5>76cc5f0d45306207e6aa0093298fbca6</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/x-ini</file_type>
            </value>
            <value>
              <SHA-256>581a0e48968a7b57ee8b13dc73338563d4bbf95164438da4dc0cb0fd6f404921</SHA-256>
              <SHA-1>737526167b81f08d63049873c2958e3e5d58b1e5</SHA-1>
              <MD5>41e010aaa2a6f895ab6b48f884bbf381</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>SOFTWARE\Ghisler\Total Commander</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\Ghisler\Windows Commander</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Uninstall\Totalcmd</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </registry>
        </iocs>
        <name>tcmd1158x32_64.exe</name>
        <report_id>26f72f98-02a7-4c10-a538-8d0b90c67115</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>explorer</value>
          <value>installer</value>
          <value>lolbin</value>
          <value>reconnaissance</value>
          <value>sfx</value>
          <value>overlay</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>CAB</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>evasive</value>
          <value>fingerprint</value>
          <value>installer-heuristic</value>
          <value>packed</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>bef1e63be014fb5d371c1494fd1f823c3158d0d5365939bbbc7d5e64c0a7ad2c</id>
    <title>Analysis Report for bef1e63be014fb5d371c1494fd1f823c3158d0d5365939bbbc7d5e64c0a7ad2c</title>
    <updated>2026-10-05T11:14:32Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac386e256de8c4dada32043</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac38695dedbc9646d41acdd</flow_id>
        <hash>bef1e63be014fb5d371c1494fd1f823c3158d0d5365939bbbc7d5e64c0a7ad2c</hash>
        <iocs/>
        <name>README-PORTABLE.txt</name>
        <report_id>7b102eb1-6c3b-4620-a498-51665b0b62f5</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>3f8eb8d483dcd4a2b5d317b7a61b792c2eb2188a4e8291083a6a2561419268be</id>
    <title>Analysis Report for 3f8eb8d483dcd4a2b5d317b7a61b792c2eb2188a4e8291083a6a2561419268be</title>
    <updated>2026-10-05T11:14:32Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac386e056de8c4dada32041</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac38695dedbc9646d41acdd</flow_id>
        <hash>3f8eb8d483dcd4a2b5d317b7a61b792c2eb2188a4e8291083a6a2561419268be</hash>
        <iocs/>
        <name>.portable</name>
        <report_id>7baa658a-3032-4268-bb31-57c5d6f7b74f</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>865b1f140486360e805d7d73a08e02cf68dbe0bcf30d14bbe5f2d4e424a103de</id>
    <title>Analysis Report for 865b1f140486360e805d7d73a08e02cf68dbe0bcf30d14bbe5f2d4e424a103de</title>
    <updated>2026-10-05T11:14:32Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3870956de8c4dada3204b</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac38695dedbc9646d41acdd</flow_id>
        <hash>865b1f140486360e805d7d73a08e02cf68dbe0bcf30d14bbe5f2d4e424a103de</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>12319f792ea7d5face725c7b87d5fee40435a694940afd58908958e2fb358a16</SHA-256>
              <SHA-1>be79a69fd1a37f37845ae10f1172cd130aa5d9a8</SHA-1>
              <MD5>26bbabd8d0e868809502c1ad60161d61</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>1381332468e58364291017f50744381b7ce89f68a559ec500c08df0414fdfe07</SHA-256>
              <SHA-1>9112f35b0c0a09c788ae6e4cd979307ce7176f83</SHA-1>
              <MD5>151a63a3c1adf3367e920a452228a564</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>1b941c248f21fc6086787ad137814ed8f35faaf07adb4ea6fb47cc2278a40cee</SHA-256>
              <SHA-1>d291495df12685c3fdc4abeeecd11abe7b6279a8</SHA-1>
              <MD5>e0640d822fd7dc09e48fe4aea8c16ec8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>2246c8296d1a69db9b1b36ec7653137475b8c36078f1a40abf5f864a9ea62ee8</SHA-256>
              <SHA-1>aad3664895cb73ab59d8f4ca20a0d8949fdc9020</SHA-1>
              <MD5>47572c2d82828f49bb3eb91800b80401</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>239348839b34b7a3441c12a4fd6644131f57d5c3c07a057bb3c615a6d11c9cd0</SHA-256>
              <SHA-1>0ac56b1d40e6910051cd205c6449cc48239da892</SHA-1>
              <MD5>61d022836e89c74444ba525a894ca5ff</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>29b91fb62fd5d57a725c2a956a89383281c17a78465f73e0e82d9631da8b5055</SHA-256>
              <SHA-1>6f496a3a70580b91c7dc18daf4a30b9b7d83fb26</SHA-1>
              <MD5>08dbec8776c75bc2927586223b276258</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>3265287aaeb45af6a456892339de44f102f5564c98f2091a3b681b8b2dde9f00</SHA-256>
              <SHA-1>22dcc4c361a88fe74aa05138d511b9edf9ac43e6</SHA-1>
              <MD5>64021420c1560f739a4d36849083728c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>3f5139462aaa0c85027a1f87b69a9a3feb984006d9d9e406e47da84fb8b2f09b</SHA-256>
              <SHA-1>219811a3df1fbe9d3e7adb416d7c9b3c68d87f2e</SHA-1>
              <MD5>386772d60dc394f9032d05eb2d129fe1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>4e3a03e768d8a8c72760277ccde3eefcdec947b57cdae42f0d874c5b8bd97984</SHA-256>
              <SHA-1>55c8b2ea00cdc5caab265092052ceeb557dc7ebc</SHA-1>
              <MD5>f53a804dc3eb7889633a031ca5be798a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>6aa14563f46ff50ce31bad2b73bb436a9a7f25825a93fb2a65e83e7e696883f3</SHA-256>
              <SHA-1>22449efe64a4fbf2203a8acfe36448e72482116f</SHA-1>
              <MD5>22c94d802a42092a9ae6c549d2b282b8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>7e8dbab0d01a10dcc88238880b63c640e6ac11df0cdd3f7cf56004fddf79d9a2</SHA-256>
              <SHA-1>6a6fb5d559ce2a77ee630c6a8476b41521b5798a</SHA-1>
              <MD5>0d841228680b1c3d9dccc33b976cb1c7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>95c9b1949490f787efa74244dc6ccec67df7c00ce002b743219e428916f0caa6</SHA-256>
              <SHA-1>700bf030cf87985b448662681c293107300058ee</SHA-1>
              <MD5>898ac50d6b85deb31405c4313b800572</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>a660fc3d332057637f1a4df9bedf132c26f3b059f3ffa287e24cd617945d9906</SHA-256>
              <SHA-1>ce2e697858f63a59468300b920dca0cb28290d9c</SHA-1>
              <MD5>0c89dc1baabf3aeb0a1eef945e11f91b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>aa74c9c3e42b1bfe0e313ba03c0c7524fe9f49fe81d0b5e469e91284aaa3af97</SHA-256>
              <SHA-1>2f86d4aea200ffcccc11327a9f5eddcd3a4b921f</SHA-1>
              <MD5>7df154dd16b2a423b5ebf76eedb8673b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>b4a6873670ea12a869d5b90c87d4aba897aec06b4d395d78a5e7b903d6347ed8</SHA-256>
              <SHA-1>40bdf97d6a1aeba6933747965526a07ad12f69ad</SHA-1>
              <MD5>b5c4b216a5335d2b99a8b5cafde2be29</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>c314337619ce75b30143bedfc1c92d25c7a22247f527dc23c78081006aacfb3d</SHA-256>
              <SHA-1>ff5f16d0a880f76ea3278e87d433a1177dc95994</SHA-1>
              <MD5>45201ff9ad0ab83d65eb9ad793ecf6b0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>d39093c8299bb614316924ed206c9d15cfd33f60ca6d33b50ad868b70f4934f4</SHA-256>
              <SHA-1>18bd99bdae7d3aacd018eb57a6305e7d9b1cbf38</SHA-1>
              <MD5>c4a1d6d1b93c9c764fb8d9d8fd6c601f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>f8c100d60122341032941e72e534514b8234b37fe9b2aa6676406fbc14dc71e2</SHA-256>
              <SHA-1>d0e2f24ef44651a0acf5ed836a50a21badfd45a0</SHA-1>
              <MD5>05c69b8cbb62f51ce2f6d7071f712ff8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
          </files>
        </iocs>
        <name>DashBeam.exe</name>
        <report_id>51f2db37-1515-4e98-a216-ab29c26ae891</report_id>
        <tags>
          <value>peexe</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>keylogger</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>rust</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f5c1a04cfb31d0b2864b44b7a095667696cd6c524adf460cfe5c13e8444db685</id>
    <title>Analysis Report for f5c1a04cfb31d0b2864b44b7a095667696cd6c524adf460cfe5c13e8444db685</title>
    <updated>2026-10-05T11:14:06Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac386b2d130e7ad452673ca</_id>
        <file_type>application/vnd.android.package-archive</file_type>
        <flow_id>6ac3867cdedbc9646d41ac41</flow_id>
        <hash>f5c1a04cfb31d0b2864b44b7a095667696cd6c524adf460cfe5c13e8444db685</hash>
        <iocs>
          <urls>
            <value>
              <url>http://127.0.0.1</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schemas.xmlsoap.org/soap/encoding</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schemas.xmlsoap.org/soap/envelope</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://dns.iroh.link/pkarr</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://github.com/tauri-apps/tauri/issues/2549#issuecomment-1250036908</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/tauri-apps/tauri/issues/8306)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/tauri-apps/wry/blob/a0403b9e2f1ff9d73be7dce1184f058afcaa1d82/src/lib.rs#L1130)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/tonyantony300/dashbeam/releases/tag/vMalformed</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/whatwg/html/issues/7428</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://staging-dns.iroh.link/pkarrurl</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://github.com/tonyantony300/dashbeam/releases/latest/download/latest.json</url>
              <origin>APK_DECODING</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>github.com</url>
              <origin>APK_DECODING</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>dns.iroh.link</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>schemas.xmlsoap.org</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>staging-dns.iroh.link</url>
              <origin>INPUT_FILE</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>128x128@2x.pngicons</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>info@e-szigno.hu0</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>49.13.207.244</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>49.13.237.105</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>140.82.121.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>150.171.109.107</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>1.3.6.1</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>127.0.0.1</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>239.255.255.250</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>5.5.7.3</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>6.16.26.37</ip>
              <origin>INPUT_FILE</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>9c66f88b79ad60d6d5b63839bbb709b0cdfd591898c35ac187c3c272c47b52ae</SHA-256>
              <SHA-1>88f62ae3ca8827e50a463322427d3bc8edeb378e</SHA-1>
              <MD5>fab4aa3bc10fe3020538e90252e9b8f3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>b77d77ae19836e21914c676730ede7269bc4907496470c692dfef85eee0e34cc</SHA-256>
              <SHA-1>d59d245e51c74ddca6765f14b8b7981af3800a00</SHA-1>
              <MD5>35ed02ac4ec6ea5c7590d2e97ddd56e7</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>5dadaaf70eeb3acf8f599b0fb3f8e4829099b5658c3cbbded391dad5d0c92a74</SHA-256>
              <SHA-1>5d7dba057d0276e6ca37d603bd5b808dda7695bd</SHA-1>
              <MD5>8e5eb5de86dbb2b920833e56b01fcfa7</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>67e2ef820a73fdc13e262fb121c4592429931f0aa9beca05462bf67f9263f965</SHA-256>
              <SHA-1>8fd73972171d5a229e9b51c955c86f3f277f8e7c</SHA-1>
              <MD5>d5f6258bd04a569184967d7ea0bc9bc0</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/json</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>6be7d5694e5ffd5e92b7a0f14fccf27e9f7c2273d876d67fae3c09a8e79bbe40</SHA-256>
              <SHA-1>d0be22766d0ee8bceed6c07dce01c27204214b48</SHA-1>
              <MD5>c9c9d023201bc007e0641c29ce316ba2</MD5>
              <origin>URL_REDIRECT</origin>
              <file_type>application/json</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>6c084bc77fa826c79adcfc9d0d93d378f61b414ea0c3342692af6e481121e851</SHA-256>
              <SHA-1>c982f460ea68fe108c9762db6c72faed99f487b0</SHA-1>
              <MD5>47a06f5fc6bde673ddb5b1180c8924c4</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>b11395341e3d380938a769c864ed92c8d6f8e19c97dc68a44058aa8b79bd8189</SHA-256>
              <SHA-1>263d02a2a575a09e00be74d90b6e4e15912b8d98</SHA-1>
              <MD5>880ade9bc8566b93cc53f23856f63697</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>a7dadb0903aa6fcab9d57af575a88c37f6a826ea742deb4e5d51986bce38d4de</SHA-256>
              <SHA-1>c55f5a603ed0b699030edbf7f68aeb311d7a13db</SHA-1>
              <MD5>ae309be3cf805b9f2e1a8b7a890e78d0</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>479b21ffd7f17068ce57a51e163cf82674fa704ff85d2440ae18354612b10160</SHA-256>
              <SHA-1>98156e131f9750c2e2ba740f0b0f8a8ddfa9ca82</SHA-1>
              <MD5>5855c7aca0e8b3fc08797861629cfb76</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/json</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>a247ea7a1fb964c0315ff63ec868a8e61d9ab138e468cf6f9764b5012f0fc103</SHA-256>
              <SHA-1>d82e87876c1cd3648fa578dd82ecb13351a3151e</SHA-1>
              <MD5>ab31ad31b7410dc06dd029bed34f081e</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/json</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>ff489364a71976a1040b52245e5262e4d756053fac543086b34b8faeb6eb71fb</SHA-256>
              <SHA-1>cb7a6df6a5dd58f3a4e417ef47fd31e2ec5b5fcd</SHA-1>
              <MD5>4871f662cc81d0ea064a0fcbb84b4d67</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>259d931330a804c0ab362cdc73b63123aaba5ea86d729950290373c2c9453d34</SHA-256>
              <SHA-1>dcdc26ce7406c2ab4d04e0e9d4e0094ad9466c62</SHA-1>
              <MD5>568db4b8f10083f9efc0e242bc43317b</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>application/json</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>410c77864d0d375e63119034e3165e7e3cdfa6ff7b2ad0a647874ba56c465548</SHA-256>
              <SHA-1>e0ff413653970a94ff3793a44b150880f8b520b7</SHA-1>
              <MD5>e2ffb2de3fa109d310dcd72a43ee6c9d</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>application/json</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>82759fa5bd712df645e0f888d1c7b913d7cd5f25907335bbd509ed2a15d42a19</SHA-256>
              <SHA-1>244649e6327fb953ebc97a8ffdda5ab7a54e6d11</SHA-1>
              <MD5>77f23732d92ba5a42efd1b4ffae331eb</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>application/json</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>90610a7f98fbec5b01d11bd5b877dec3178633edc01018b4196f5db6fd2ec5c1</SHA-256>
              <SHA-1>31c11b6f73097bbdd67780a83cd3e2eb2f0c2d04</SHA-1>
              <MD5>0e9e70c251d23debec3e4bb8eff11e34</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>DashBeam-v0.7.1-arm64.apk</name>
        <report_id>f33ebabe-2dea-4d1f-abef-50a653100584</report_id>
        <tags>
          <value>apk</value>
          <value>xml</value>
          <value>txt</value>
          <value>html</value>
          <value>json</value>
          <value>signed</value>
          <value>base64</value>
          <value>obfuscated</value>
          <value>persistence</value>
          <value>evasive</value>
          <value>fingerprint</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d64a0468f5b5b0b0fc5b2188450bcd655b70809d97b1c4535f2884635094377d</id>
    <title>Analysis Report for d64a0468f5b5b0b0fc5b2188450bcd655b70809d97b1c4535f2884635094377d</title>
    <updated>2026-10-05T11:11:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38605d130e7ad452673aa</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac385d336412e623d2c7cd8</flow_id>
        <hash>d64a0468f5b5b0b0fc5b2188450bcd655b70809d97b1c4535f2884635094377d</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schemas.microsoft.com/SMI/2005/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.106</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>89.167.91.206</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>013ffb357a9c059b4700faa82edc6ed1c4e03f80a4fb3bdbb6010dd8c5780527</SHA-256>
              <SHA-1>aa5c75367bf3a337062935417659b8d5797ceb6a</SHA-1>
              <MD5>6a4de51552cef5f0ed621733a597cbd3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>04703b620701b09d71629b371b88454e989f0049b9dc738dd5f85d437e8b60c9</SHA-256>
              <SHA-1>78ee0b5d3f19ed6beb1439502e73fb17bf5e9410</SHA-1>
              <MD5>197277651df397ee931c4770a77139aa</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>26a6223f5623e45cd64181ff93c6d178abd00d3f2ad41f1d1222381f90bbf0b5</SHA-256>
              <SHA-1>e3300091ba9256654a3cbb470c7533830a34cab1</SHA-1>
              <MD5>cb155a58b9738e2ce7f0202ecfa2558a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>728d514fdcaab8770f1a113f141428b4860027f6685356d74274c03e194d68a6</SHA-256>
              <SHA-1>40845066b357fff695ee2d3e41c19e28442671ac</SHA-1>
              <MD5>28683b6aa3bf8a170d1ceb9fa05bf362</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>9b2a0b2f2e2895f95f52428ce44e85b6291513f065df2f50fa4750e87f0802d1</SHA-256>
              <SHA-1>ee2c466c0c9106654b7b31688816a0883183037c</SHA-1>
              <MD5>5db9c424f8d8a6aafce6a81d38c23b6a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>b10e28a32eddb2ab20a46ceae59d9c0786911eb20f0c8dd2a28421f226ea2b8b</SHA-256>
              <SHA-1>6883ce60e71a83424db0b41d0ab6bf61080e3de2</SHA-1>
              <MD5>d59e0d372ea5fd8c1f4de744376a6af4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>c355fc41b056566d3f8de7f76c65fb173b81f0a38cc982af095923cb2b67e981</SHA-256>
              <SHA-1>e0de26531c30563f6996f208f6f922ec873e2456</SHA-1>
              <MD5>ae8925b0e216452f213f00796922dd7f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-7z-compressed</file_type>
            </value>
            <value>
              <SHA-256>d06002f9e317adc6377c0bc9af92fa7e9392fd74cd9928fd911729a1e8e3e6df</SHA-256>
              <SHA-1>7454c492fdd935a58fad5713290c48b8abb277ba</SHA-1>
              <MD5>794fe7995c967ebd479f68359353ebc4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>ed65f792943b4496d98ae4ffeb6cf2879f66659a5ccf4a97d757aa8ac01158ca</SHA-256>
              <SHA-1>c51ce11d8aa49e4f06f57b7a25273aa561626a2b</SHA-1>
              <MD5>656a46a1469ab351cbbabb430222cfef</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>1da513f5a4e8018b9ae143884eb3eaf72454b606fd51f2401b7cfd9be4dbbf4f</SHA-256>
              <SHA-1>1bb477811ecdb01457790c46217b61cb53153b75</SHA-1>
              <MD5>eb7e322bdc62614e49ded60e0fb23845</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>23234f1a180cd0ccbc25bfd8bb658c877a5beb91dc7c39ec7c6582343d72a06f</SHA-256>
              <SHA-1>6ff123c431a006d53678ea5f54d4d7160f47323c</SHA-1>
              <MD5>ba653a92e6b42ca8112115ea7db15495</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>2bff20bd679d45166b8c2d039044a4ca16189e6d69ff9c82345b4c1306986ec4</SHA-256>
              <SHA-1>436615113bcfdadb71a60d61f73f97deb655faf1</SHA-1>
              <MD5>d966f9b3019464b9447526ca4f7f5082</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
            <value>
              <SHA-256>32d3366005db7baf6c95b4dfd901b2fb2776b71d83f762fcb224253b1adb3d9f</SHA-256>
              <SHA-1>7c93311c26c5d121fdd99251dbe0fdf4cf0e6f85</SHA-1>
              <MD5>445516a023ad4e27b0579b02615be317</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>432bdb3eaa9953b084ee14eee8fe0abbc1b384cbdd984ccf35f0415d45aabba8</SHA-256>
              <SHA-1>3e2ae05865fb474f10b396bfefd453c074f822fa</SHA-1>
              <MD5>07504a4edab058c2f67c8bcb95c605dd</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>46e875296485409bde0482143e86dab9c675f2f3e67c99f3e2ab00b737532991</SHA-256>
              <SHA-1>5f2ac8af1cc22e6b6e4c1fda3d73b470f922b7c7</SHA-1>
              <MD5>ee4c01cf869ae549698312ea2726c5dc</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
            <value>
              <SHA-256>470eaf5e67f5ead5b8c3ecc1b5b21b29d16c73591eb0047b681660346e25b3fb</SHA-256>
              <SHA-1>c2487c59eeeaa5c0bdb19d826fb1e926d691358e</SHA-1>
              <MD5>6bdf25354b531370754506223b146600</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>4de2629279dd603399c4947700e8cc4edf5c32c5c5e9fe1b1a2ea0f165282f52</SHA-256>
              <SHA-1>b9936531303f671d06fa36fd106cf4f150c18380</SHA-1>
              <MD5>f3fdd3f9088ff2d0b4cf677ac1b838c6</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
            <value>
              <SHA-256>6d05e2a4e04b0e0fe406abf3822fbc64d9ffa903869bbc4d50967958e0f9d8c8</SHA-256>
              <SHA-1>d99d237c8fe55d7493ee34cd349bed576eba6c2c</SHA-1>
              <MD5>3201c16c31250fe095ac7db552765d87</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
            <value>
              <SHA-256>9657871fdd714c96a3a21f59abf04abb14944516c2a10c8cb606c12a71a75957</SHA-256>
              <SHA-1>51ecc880e3b6d1447a6f9e9fb6646278ca7a393a</SHA-1>
              <MD5>910de767458feabfa4de2d7066e825cc</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>9cf684ea88ea5a479f510750e4089aee60bbb2452aa85285312bafcc02c10a34</SHA-256>
              <SHA-1>787ccb4e18fc2f12a6528adbb7d428397fc4678a</SHA-1>
              <MD5>df216fae5b13d3c3afe87e405fd34b97</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>a6ef5a5a1e28d406fd78079d9cacf819b047a296adc7083d34f2bfb3d071e5af</SHA-256>
              <SHA-1>d4b3147f23c75de84287ad501e7403e0fce69921</SHA-1>
              <MD5>29caad3b73f6557f0306f4f6c6338235</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>ae3ee0b7298a9a7f9ebbd2afd516b5eb3e26cbb28cb705b29f0f55b28955d9f4</SHA-256>
              <SHA-1>ad2b89e5510c80c585ffc1c687d7c7548490983e</SHA-1>
              <MD5>6f66eb93644f835b4a4f15458442dbfb</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload; format=pe64</file_type>
            </value>
            <value>
              <SHA-256>b6f342fe8a568cc14467d8fe12e266e63aaf805ecba430a51fd1af65b52c6df7</SHA-256>
              <SHA-1>8cea0d4414b1fbccb8f6f7258f24c1a5f5530f9d</SHA-1>
              <MD5>69e504f90e6bab73a9ef2456500ccf95</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>b87a4fca8a0024a915ae86e36951cb7cea442948d9982d4247e49492445ba664</SHA-256>
              <SHA-1>8272f4761a3f2aca2bfaec6fcf08c82a9f36a65a</SHA-1>
              <MD5>0861ae63da2d00590369bb11b3857551</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>c218145bb039e1fd042fb1f5425b634a4bdc1f40b13801e33ed36cfdbda063ed</SHA-256>
              <SHA-1>a4358379a21a050252d738f6987df587c0bd373d</SHA-1>
              <MD5>bf2e140e9d30d6c51d372638ba7f4bd9</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>c88bc7ea0c20769847a0403e188e273a0897d1c77dd72cc4b45471fc67e0d5e1</SHA-256>
              <SHA-1>6550cde7359a1b3450d8c0937affbf0252fa4b82</SHA-1>
              <MD5>e3267c5ed8158da2b7e2679107ce1394</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>d31d5a3e9362e5fcb5b08ce2e7f471e5b8a354e75b7734c1874a658d761ad24c</SHA-256>
              <SHA-1>2e84f298f2e21f379633e9b603ab4bbfbd0e98d5</SHA-1>
              <MD5>5f1ee638270f60cd2c1b6cd930d73ff8</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>ec2812d41c773e7cc7f1f3c90f6e5df5421a7c7128b076713e5a9d408a535b92</SHA-256>
              <SHA-1>0e45a8c82b167bd4decfa9890e933e931b06a2b8</SHA-1>
              <MD5>68208bda05df4a15c5a5a06d7805ceeb</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/vnd.ms-htmlhelp</file_type>
            </value>
            <value>
              <SHA-256>f5f2174daf36e65790c7f0e9a4496b12e14816dad2ee5b1d48a52307076be35f</SHA-256>
              <SHA-1>958f7ff322475f16ca44728349934bc2f7309423</SHA-1>
              <MD5>1cf6411ff9154a34afb512901ba3ee02</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>db616b63d363d47256fade9620341dfcc6ffba09658795c09552baf5c0964fde</SHA-256>
              <SHA-1>bd1c0b8a386c74282ac24cdc619b3ca7b812e14a</SHA-1>
              <MD5>f837cc1ff73de8e62df289b50771af61</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>23170F69-40C1-278A-1000-000100020000</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\App Paths\7zFM.exe</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </registry>
        </iocs>
        <name>7z2601-x64.exe</name>
        <report_id>d49cedd8-7c9c-4708-9d5a-016bcb2a110f</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>wiper</value>
          <value>fingerprint</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>reconnaissance</value>
          <value>installer</value>
          <value>sfx</value>
          <value>crypto</value>
          <value>obfuscated</value>
          <value>overlay</value>
          <value>microsoft_visual_cc</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>726ea19bfe8218e65fd1955d6bd9f1b02bef8c4ac49d19a9f4f59404290021a8</id>
    <title>Analysis Report for 726ea19bfe8218e65fd1955d6bd9f1b02bef8c4ac49d19a9f4f59404290021a8</title>
    <updated>2026-10-05T11:10:10Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac385add130e7ad45267398</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac3859136412e623d2c7bb6</flow_id>
        <hash>726ea19bfe8218e65fd1955d6bd9f1b02bef8c4ac49d19a9f4f59404290021a8</hash>
        <iocs>
          <urls>
            <value>
              <url>http://ldgr-support-safe.s3-website-eu-west-1.amazonaws.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/f/av0/rch/ikbtr/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal?lang=auto</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://challenges.cloudflare.com/turnstile/v0/b/d76008a69eab/api.js?onload=zaERg6&amp;render=explicit</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://trust-compliance.es/cdn-cgi/challenge-platform/h/b/fo/2692709453:1791194717:nrSEE6tGSePDEvR8MA2NfuhgobhEe_vtR8Cdd82uX9E/a45bfa885cea64e8/t0eDTF4UCuYp559Qa21VT6s76xpquHHrCDonj0VkoB0-1791198613-1.2.1.1-Sk6wY8V_SpNPUldY5r..pNpkaALKPHJeDWGAXYeWf2m0.l4MYROcwD8afAlmnh4C</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://trust-compliance.es/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a45bfa885cea64e8</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://trust-compliance.es/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://trust-compliance.es/trustwallet-support-chat/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://trust-compliance.es/trustwallet-support-chat/?__cf_chl_rt_tk=x4lYQPXYtPpvqSh6Yygy9QQqCSopm1Q85P.9otp1V20-1791198613-1.0.1.1-JGBLPz37OIg9YO5vorzTb0sGzzPyy2jZaStASSCtvtY</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/privacypolicy/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com?utm_source=challenge&amp;utm_campaign=m</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>1.0.1.1</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ldgr-support-safe.s3-website-eu-west-1.amazonaws.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>challenges.cloudflare.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ldgr-support-safe.s3-website-eu-west-1.amazonaws.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>trust-compliance.es</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.cloudflare.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.18.95.41</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>172.67.173.78</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>3.5.74.53</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxp://ldgr-support-safe.s3-website-eu-west-1.amazonaws.com/</name>
        <report_id>d85311ec-e2f0-43e3-9f0f-49ea02d741e2</report_id>
        <tags>
          <value>html</value>
          <value>phishing</value>
          <value>aidetect</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0859c524b8a63551848f0c246abddcb1d0b7b656b0fbfe879f8d85e61a9e6edd</id>
    <title>Analysis Report for 0859c524b8a63551848f0c246abddcb1d0b7b656b0fbfe879f8d85e61a9e6edd</title>
    <updated>2026-10-05T11:10:07Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac385c3d130e7ad4526739d</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac3858ddedbc9646d41a9df</flow_id>
        <hash>0859c524b8a63551848f0c246abddcb1d0b7b656b0fbfe879f8d85e61a9e6edd</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schemas.microsoft.com/SMI/2005/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>150.171.109.107</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>89.167.91.206</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>013ffb357a9c059b4700faa82edc6ed1c4e03f80a4fb3bdbb6010dd8c5780527</SHA-256>
              <SHA-1>aa5c75367bf3a337062935417659b8d5797ceb6a</SHA-1>
              <MD5>6a4de51552cef5f0ed621733a597cbd3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>26a6223f5623e45cd64181ff93c6d178abd00d3f2ad41f1d1222381f90bbf0b5</SHA-256>
              <SHA-1>e3300091ba9256654a3cbb470c7533830a34cab1</SHA-1>
              <MD5>cb155a58b9738e2ce7f0202ecfa2558a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>27fb1ff30fe99a0cce999ab5eb110fa8992af2af1e3adc00dbc7616707e550e0</SHA-256>
              <SHA-1>fc6d4139058055104db2d55792b2764efe3679ac</SHA-1>
              <MD5>b83ddedec560dca728a3f7dabbb1f82c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>728d514fdcaab8770f1a113f141428b4860027f6685356d74274c03e194d68a6</SHA-256>
              <SHA-1>40845066b357fff695ee2d3e41c19e28442671ac</SHA-1>
              <MD5>28683b6aa3bf8a170d1ceb9fa05bf362</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>9b2a0b2f2e2895f95f52428ce44e85b6291513f065df2f50fa4750e87f0802d1</SHA-256>
              <SHA-1>ee2c466c0c9106654b7b31688816a0883183037c</SHA-1>
              <MD5>5db9c424f8d8a6aafce6a81d38c23b6a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>b10e28a32eddb2ab20a46ceae59d9c0786911eb20f0c8dd2a28421f226ea2b8b</SHA-256>
              <SHA-1>6883ce60e71a83424db0b41d0ab6bf61080e3de2</SHA-1>
              <MD5>d59e0d372ea5fd8c1f4de744376a6af4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>d06002f9e317adc6377c0bc9af92fa7e9392fd74cd9928fd911729a1e8e3e6df</SHA-256>
              <SHA-1>7454c492fdd935a58fad5713290c48b8abb277ba</SHA-1>
              <MD5>794fe7995c967ebd479f68359353ebc4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>e45b1aeef4d6c2a8dddf4c89551e593573adc939062fae537d953c5916ce3d5d</SHA-256>
              <SHA-1>6dd15831ebdbb25e258311c55420c65b5c969f57</SHA-1>
              <MD5>1bbdb86b4edb82ebcf7960f4b1cf428a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-7z-compressed</file_type>
            </value>
            <value>
              <SHA-256>ed65f792943b4496d98ae4ffeb6cf2879f66659a5ccf4a97d757aa8ac01158ca</SHA-256>
              <SHA-1>c51ce11d8aa49e4f06f57b7a25273aa561626a2b</SHA-1>
              <MD5>656a46a1469ab351cbbabb430222cfef</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>1da513f5a4e8018b9ae143884eb3eaf72454b606fd51f2401b7cfd9be4dbbf4f</SHA-256>
              <SHA-1>1bb477811ecdb01457790c46217b61cb53153b75</SHA-1>
              <MD5>eb7e322bdc62614e49ded60e0fb23845</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>25a48d1f1cad86e81dd6504362cf039a381e14aa7a38b06cb7ba3839b735f35e</SHA-256>
              <SHA-1>95340b82ece7f2f36cd17c95413ae3b0a9b72b51</SHA-1>
              <MD5>cb81c26439cea306d2ebf1a381833baf</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload; format=pe64</file_type>
            </value>
            <value>
              <SHA-256>432bdb3eaa9953b084ee14eee8fe0abbc1b384cbdd984ccf35f0415d45aabba8</SHA-256>
              <SHA-1>3e2ae05865fb474f10b396bfefd453c074f822fa</SHA-1>
              <MD5>07504a4edab058c2f67c8bcb95c605dd</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>470eaf5e67f5ead5b8c3ecc1b5b21b29d16c73591eb0047b681660346e25b3fb</SHA-256>
              <SHA-1>c2487c59eeeaa5c0bdb19d826fb1e926d691358e</SHA-1>
              <MD5>6bdf25354b531370754506223b146600</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>59628c9d6eb48f1c945f470f9c60fcdbf1378a8b06eb98680409711d9955641b</SHA-256>
              <SHA-1>70a9f69fe9582c8d8c802663baa2d8300de7bd08</SHA-1>
              <MD5>55cde05b9f868e071c7d6cdca34913f8</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
            <value>
              <SHA-256>5a937b86702b4ee9ca878725ada8886f156fb64faf909092327bf85ca2fc159a</SHA-256>
              <SHA-1>190d80411e4616deadd477d4a80b703b3bd402d4</SHA-1>
              <MD5>7d53740d97c0dfb3e1a80473b26b3dde</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>65e4c1f855f9ef6e8f0f5df8e3f27d9eb5f07311408639da0a1ca0b8f4871b0d</SHA-256>
              <SHA-1>1d76e277293fe783aa285e466b2bc1d8b6e27248</SHA-1>
              <MD5>001e517b748eb1b61a162560058d952a</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>6ee3c0ed0b27663c1b948ae85a7c0bb073aed1498983182f3f0df1f6a8c30b2f</SHA-256>
              <SHA-1>123c7413f21a994543612e4e9bfbdde34400a380</SHA-1>
              <MD5>970a5c4eba7baea72bffe12a7cdb1a34</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
            <value>
              <SHA-256>7f7067b2264fbf8cbd1348cf7f41a0e35c928de750d53533c963ebe334dbd612</SHA-256>
              <SHA-1>702154d7a1fb9987aa29528b9e8a9c94c03da9b3</SHA-1>
              <MD5>9d2a85f642a2d88cf3d97025e37808f4</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
            <value>
              <SHA-256>9598f3bbca8e95391b8a356aee2e4cab93d9ac26eea47159ec725a55cf3bb32f</SHA-256>
              <SHA-1>71146fcadad76850bc700b02e7b4c56fee616158</SHA-1>
              <MD5>d5fa7fdb34fc53fda5e789fbc533d993</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>9cf684ea88ea5a479f510750e4089aee60bbb2452aa85285312bafcc02c10a34</SHA-256>
              <SHA-1>787ccb4e18fc2f12a6528adbb7d428397fc4678a</SHA-1>
              <MD5>df216fae5b13d3c3afe87e405fd34b97</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>a6ef5a5a1e28d406fd78079d9cacf819b047a296adc7083d34f2bfb3d071e5af</SHA-256>
              <SHA-1>d4b3147f23c75de84287ad501e7403e0fce69921</SHA-1>
              <MD5>29caad3b73f6557f0306f4f6c6338235</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>a7c4ea7942fcb3d438344f9ee0be6e56bc9becab4c715ce187202f94b42f946c</SHA-256>
              <SHA-1>b2751ef1b43e1f11fdcb71d69cc29dd3b2446277</SHA-1>
              <MD5>7906b859988b5ede1d569369b5dd5aa0</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
            <value>
              <SHA-256>b87a4fca8a0024a915ae86e36951cb7cea442948d9982d4247e49492445ba664</SHA-256>
              <SHA-1>8272f4761a3f2aca2bfaec6fcf08c82a9f36a65a</SHA-1>
              <MD5>0861ae63da2d00590369bb11b3857551</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>c218145bb039e1fd042fb1f5425b634a4bdc1f40b13801e33ed36cfdbda063ed</SHA-256>
              <SHA-1>a4358379a21a050252d738f6987df587c0bd373d</SHA-1>
              <MD5>bf2e140e9d30d6c51d372638ba7f4bd9</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>c4402ffcbe8e02ec017f958f0d188fe13ea00193623c95dde546f6621a2e4132</SHA-256>
              <SHA-1>5f1b6bf972b292a849f11f1861cd8f8ba7543c16</SHA-1>
              <MD5>85a9a1e62908bd8a43b355765b9e190f</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>c88bc7ea0c20769847a0403e188e273a0897d1c77dd72cc4b45471fc67e0d5e1</SHA-256>
              <SHA-1>6550cde7359a1b3450d8c0937affbf0252fa4b82</SHA-1>
              <MD5>e3267c5ed8158da2b7e2679107ce1394</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>e0b70a83b79c938d7a868013ef94a0b1d34ff145f1e67bb7bf9a56aa913622cb</SHA-256>
              <SHA-1>1b2f2bd1fd17aa6678015d82401a3646b96781be</SHA-1>
              <MD5>88025292079c9b1fca3906f0e8709e6d</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/vnd.ms-htmlhelp</file_type>
            </value>
            <value>
              <SHA-256>ebb037cb88bccc3ae22f46f3dbd5c9b308c31dc36002305cb4e05f56964e917b</SHA-256>
              <SHA-1>b6c61024f57dae2d2c9b3728dad4bd74ee3ec8e3</SHA-1>
              <MD5>c98b2d8b08de41ca0dedb82c0da39dc0</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>f5f2174daf36e65790c7f0e9a4496b12e14816dad2ee5b1d48a52307076be35f</SHA-256>
              <SHA-1>958f7ff322475f16ca44728349934bc2f7309423</SHA-1>
              <MD5>1cf6411ff9154a34afb512901ba3ee02</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>db616b63d363d47256fade9620341dfcc6ffba09658795c09552baf5c0964fde</SHA-256>
              <SHA-1>bd1c0b8a386c74282ac24cdc619b3ca7b812e14a</SHA-1>
              <MD5>f837cc1ff73de8e62df289b50771af61</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>23170F69-40C1-278A-1000-000100020000</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\App Paths\7zFM.exe</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </registry>
        </iocs>
        <name>7z2603-x64.exe</name>
        <report_id>1f3a9b72-4184-4cc3-9351-c49d8826a238</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>wiper</value>
          <value>adaptive-context</value>
          <value>fingerprint</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>installer</value>
          <value>reconnaissance</value>
          <value>sfx</value>
          <value>crypto</value>
          <value>obfuscated</value>
          <value>overlay</value>
          <value>microsoft_visual_cc</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>726ea19bfe8218e65fd1955d6bd9f1b02bef8c4ac49d19a9f4f59404290021a8</id>
    <title>Analysis Report for 726ea19bfe8218e65fd1955d6bd9f1b02bef8c4ac49d19a9f4f59404290021a8</title>
    <updated>2026-10-05T11:08:34Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38556d130e7ad45267388</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac38530dedbc9646d41a8e1</flow_id>
        <hash>726ea19bfe8218e65fd1955d6bd9f1b02bef8c4ac49d19a9f4f59404290021a8</hash>
        <iocs>
          <urls>
            <value>
              <url>http://ldgr-support-safe.s3-website-eu-west-1.amazonaws.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://ldgr-support-safe.s3-website-eu-west-1.amazonaws.com/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/f/av0/rch/bwx04/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal?lang=auto</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://challenges.cloudflare.com/turnstile/v0/b/d76008a69eab/api.js?onload=zaERg6&amp;render=explicit</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://trust-compliance.es/cdn-cgi/challenge-platform/h/b/fo/2692709453:1791194717:nrSEE6tGSePDEvR8MA2NfuhgobhEe_vtR8Cdd82uX9E/a45bf8541b659a07/v2vLvLzl0lZFhD.s1Rz1R0PTQyccCu4cU_0Ki7AcbMk-1791198523-1.2.1.1-YhlG4MABF9giEz3TEUz7IKHqPBYypU.lDOCIgCMP_ZeDnmkFQDMN95JK3qbA4MHx</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://trust-compliance.es/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a45bf8541b659a07</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://trust-compliance.es/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://trust-compliance.es/trustwallet-support-chat/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://trust-compliance.es/trustwallet-support-chat/?__cf_chl_rt_tk=ALLl6DaAK443bMzokhqtgbjKDdPHYvhm.KicrbNzxI4-1791198523-1.0.1.1-yGtU7BYDkX7L47Mje0c6yOZaRk.QZNZ5Dt_RVSr.bfc</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/privacypolicy/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com?utm_source=challenge&amp;utm_campaign=m</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>1.0.1.1</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ldgr-support-safe.s3-website-eu-west-1.amazonaws.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>challenges.cloudflare.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ldgr-support-safe.s3-website-eu-west-1.amazonaws.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>trust-compliance.es</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.cloudflare.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.18.94.41</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.95.41</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>172.67.173.78</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>52.92.2.12</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxp://ldgr-support-safe.s3-website-eu-west-1.amazonaws.com/</name>
        <report_id>17e17d1d-bb5b-47c2-9867-95d47f8d4add</report_id>
        <tags>
          <value>html</value>
          <value>phishing</value>
          <value>aidetect</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>661faee0e7c5c959724dc0db30a76ba67b5c8ef2dec7180eb2f649de77bf79ee</id>
    <title>Analysis Report for 661faee0e7c5c959724dc0db30a76ba67b5c8ef2dec7180eb2f649de77bf79ee</title>
    <updated>2026-10-05T11:07:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38542d130e7ad45267383</_id>
        <file_type>text/x-shellscript</file_type>
        <flow_id>6ac384e836412e623d2c7936</flow_id>
        <hash>661faee0e7c5c959724dc0db30a76ba67b5c8ef2dec7180eb2f649de77bf79ee</hash>
        <iocs>
          <urls>
            <value>
              <url>http://104.168.4.206/adissarm5</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://104.168.4.206/dissarm4</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://104.168.4.206/dissarm6</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://104.168.4.206/dissarm7</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://104.168.4.206/dissmips</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://104.168.4.206/dissmpsl</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://104.168.4.206/disssh4</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://104.168.4.206/dissx86</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </urls>
          <ips>
            <value>
              <ip>104.168.4.206</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
        </iocs>
        <name>bins.sh</name>
        <report_id>fe125e35-45dd-4a49-a8af-c042ee755e6c</report_id>
        <tags>
          <value>shell</value>
          <value>evasive</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T11:06:32Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac384c589017dd18dc1be00</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac384b836412e623d2c78b3</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>1af6cde0-c2d7-4b00-9385-1218dfadfd68</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</id>
    <title>Analysis Report for ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</title>
    <updated>2026-10-05T11:06:27Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac384c1d130e7ad4526736d</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac384b34c2119a4a0856035</flow_id>
        <hash>ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://card.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ebookjapan.yahoo.co.jp/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.lycorp.co.jp/ja/inquiry/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://privacy.yahoo.co.jp/notice/globalaccess.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/common.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/shutter.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/css/subcommon.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/cdo/privacycenter/2023renewal/img/favicon.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/images/riff/4.7.1/riff.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.yimg.jp/yui/jp/mh/pc/1.5.6/css/std.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013785</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccOverseasuse/s/article/H000013791</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccPrivacypolicy/s/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/PccYjcommon/s/article/H000013150</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.yahoo-net.jp/SccYjcommon/s/article/H000009998</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/privacypolicy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.lycorp.co.jp/ja/company/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.mofa.go.jp/mofaj/area/osce/s_kikou.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.yahoo-help.jp/app/noscript</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cn-dqsb.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>card.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ebookjapan.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.yahoo.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.yimg.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.yahoo-net.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lycorp.co.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.mofa.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.yahoo-help.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://cn-dqsb.com/</name>
        <report_id>5a93f04d-2817-4cd4-97de-68fc36b69d5c</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>01c644aa76c644e78f559f2b4b8d1580c2334d821c79e0de222da56d5a96ecaa</id>
    <title>Analysis Report for 01c644aa76c644e78f559f2b4b8d1580c2334d821c79e0de222da56d5a96ecaa</title>
    <updated>2026-10-05T11:05:24Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38482d130e7ad45267358</_id>
        <file_type>application/x-msdownload; format=pe64</file_type>
        <flow_id>6ac3847236412e623d2c77a7</flow_id>
        <hash>01c644aa76c644e78f559f2b4b8d1580c2334d821c79e0de222da56d5a96ecaa</hash>
        <iocs/>
        <name>file.exe</name>
        <report_id>13121d53-4298-437f-9bac-5f4ec4aae580</report_id>
        <tags>
          <value>peexe</value>
          <value>anti-vm</value>
          <value>golang</value>
          <value>invalid-signature</value>
          <value>self-signed-cert</value>
          <value>signed</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>c2b0a1c63be9d34ee7a0c1aba55dad29988c43c2909114fb9f721a121730481e</id>
    <title>Analysis Report for c2b0a1c63be9d34ee7a0c1aba55dad29988c43c2909114fb9f721a121730481e</title>
    <updated>2026-10-05T11:05:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac384a0d130e7ad45267363</_id>
        <file_type>application/vnd.ms-word.document.macroenabled.12</file_type>
        <flow_id>6ac3846836412e623d2c7795</flow_id>
        <hash>c2b0a1c63be9d34ee7a0c1aba55dad29988c43c2909114fb9f721a121730481e</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>bd0d27be600aac76fc108cbdb20a5b658dae81eeb266e94112ebdc2b49a32d33</SHA-256>
              <SHA-1>fc3f88f4f2995a5424237859006a196cbfea0958</SHA-1>
              <MD5>844862aabdeca6550bd86b0333a798d1</MD5>
              <origin>VBA_EMULATION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>7E891AF3-23C7-4FE8-8846-F5CD303BD3D0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <revision_ids>
            <value>
              <revision_id>0020407C</revision_id>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <revision_id>0026293E</revision_id>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <revision_id>00D635D1</revision_id>
              <origin>INPUT_FILE</origin>
            </value>
          </revision_ids>
        </iocs>
        <name>c2b0a1c63be9d34ee7a0c1aba55dad29988c43c2909114fb9f721a121730481e.bin</name>
        <report_id>4658116b-4873-4013-b2ee-8bd215931afb</report_id>
        <tags>
          <value>cobaltstrike</value>
          <value>predictive-alin</value>
          <value>evasive</value>
          <value>reflection</value>
          <value>downloader</value>
          <value>lolbin</value>
          <value>rundll32</value>
          <value>docm</value>
          <value>macros</value>
          <value>macros-on-open</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e000b6ed57da48da099dff02a9fbef8eea9fd0c4ed0abdf6f7dc2ce2826cf9ae</id>
    <title>Analysis Report for e000b6ed57da48da099dff02a9fbef8eea9fd0c4ed0abdf6f7dc2ce2826cf9ae</title>
    <updated>2026-10-05T11:02:23Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac383c5d130e7ad45267326</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac383bd36412e623d2c752b</flow_id>
        <hash>e000b6ed57da48da099dff02a9fbef8eea9fd0c4ed0abdf6f7dc2ce2826cf9ae</hash>
        <iocs/>
        <name>9968241_ddc3a329-7b2f-4452-8242-0282e97f4f62@9968241</name>
        <report_id>e3e2c8c3-f178-4d8f-883e-815467009b6d</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>922f5546f71905d0eccab2f7383621198b34b97ad65e46ac2ef0c9edf814ec22</id>
    <title>Analysis Report for 922f5546f71905d0eccab2f7383621198b34b97ad65e46ac2ef0c9edf814ec22</title>
    <updated>2026-10-05T11:00:10Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3836dd130e7ad4526730d</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac3833836412e623d2c72fb</flow_id>
        <hash>922f5546f71905d0eccab2f7383621198b34b97ad65e46ac2ef0c9edf814ec22</hash>
        <iocs>
          <urls>
            <value>
              <url>https://aka.ms/dotnet/app-launch-failed</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://aka.ms/dotnet/download</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://aka.ms/dotnet/info</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://aka.ms/dotnet/sdk-not-found</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>aka.ms</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>2.23.246.9</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>00a5079ceb19a79b3f1a590fcb54517c57432ee7ce6dfc2b85b2888f7a2e51eb</SHA-256>
              <SHA-1>aea760fdb38aa2d17d9d764739caeb062fecd000</SHA-1>
              <MD5>0ca5f5e39b744ff70573e27bb44f05ca</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>01625b0382d7ccab664ddb0997de2bb66e059fc547061f3d830914d6229a07f6</SHA-256>
              <SHA-1>221c19217f434bc24c7623ea042582ccf4658019</SHA-1>
              <MD5>024bb8b4d8c125f13731bfbc92323cd6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>1345e0c0878a9869f102547f9b26fa66009e5d59564542bce44dc213374433ac</SHA-256>
              <SHA-1>929c891f21284c59b01d31a8c32414f3e134438e</SHA-1>
              <MD5>a72d480276160335d2bfe129f8414335</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>3f818a44077444c9419cb109e7c1380333be32f58fe9988c46dac801e47a42ce</SHA-256>
              <SHA-1>d498af2a59bd83152a5ea848dcdc8a0db4c54efe</SHA-1>
              <MD5>4ce03f4718451bcf1e7539761adcc8f7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>46f03dfc43ae50d8678f501a48e1c2e8e148cbb84ed6114dbc835189da96a6e3</SHA-256>
              <SHA-1>c58c9913c2b091206a56d8ece5daa5a6911c1021</SHA-1>
              <MD5>a999b84f9edff609067deaee23b64edd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>4ba4d0fe3ac76089cdc2bf0830454ed2beb12930316d91e356b51efdd5d7bd13</SHA-256>
              <SHA-1>7dcce51ecfb90a47ec1ded58a18c7cd7f3d47287</SHA-1>
              <MD5>3dc859857e0b004687b1befef4f66c89</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>8d0763a2035e9d71d63312f740de6d5b4f1e7f287d5fe5285aca094b2533a0f6</SHA-256>
              <SHA-1>338837e2b770ed94e6175d5d6161ce3eca7d0cc0</SHA-1>
              <MD5>eff71a23b271d32ccb232492937526ff</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>91fec7c0e340dfe8d080d76f7243bc9a19919bd98110987b0222218d706233c9</SHA-256>
              <SHA-1>293af7de87598e8495813451ba2db490eb7e55dd</SHA-1>
              <MD5>c79099c74ef2810ac8c54c7d32e4b912</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>9beb1ad9f0f3795a3b3522713e0938d05aa45e4cda4f06f576205221941d655f</SHA-256>
              <SHA-1>16e84d22e961cd0455ab2ba3fb6f1813fa773d91</SHA-1>
              <MD5>0a2cd76b80889d8895f4fa78e4a789c7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>ac83d9594018ef66c873362b90ec704e82dd87029dfc0de7549b23cea6e3d25e</SHA-256>
              <SHA-1>9d2595107a8283ad71ab0e4885fde38cb79282f5</SHA-1>
              <MD5>783e9ec36b9ca47a0311af172b8d273d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c94187c138e529810d1b0158f71939c5ecaf557d64b04dae3e7d4305134e17a2</SHA-256>
              <SHA-1>c99357096dfc6e2d2db2d8a604d92c6694a613b7</SHA-1>
              <MD5>6f16a0fb296fd21a6fd641efdf72bd88</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>d35c695c2038347518f114ca36553fd308f15261e1ece25ad44c8abb0da40671</SHA-256>
              <SHA-1>efff6fbf959b0972985afbc9d85e066bbe33c065</SHA-1>
              <MD5>c6dde0088abeff7d5e052c8fdbbbd295</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>dc59a7b5ba079cf8e0acd692eaf4d3dd2df6eb35f3ea4701ad6a0f54016f2931</SHA-256>
              <SHA-1>86986eb40ef8bf9a7b3023aa6619d88e14134310</SHA-1>
              <MD5>f2439f6ad2c27e2e36e936e9dfab4ff9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>1ddc02491c3e07f4d821c890259a68373e16ca5dd6f13f34b8258f4a610a7b0f</SHA-256>
              <SHA-1>4a38e6e353dd1342a387d213a64625e101a0f596</SHA-1>
              <MD5>c04801654b8877c1266d85f93e1f2874</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>d7cc601b0db20a2aa06317f36b3a4df4d5b3a1497ae9136e00d98d8856a565b9</SHA-256>
              <SHA-1>9268f4c3298b92ba3da963c70d44ecf875a744dd</SHA-1>
              <MD5>7416838f259b49fb80d75e46e002afba</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>6c9e7f7456d20ea3e2b63f11d996e9f2614bcf8931f79cbf91c4df9fdad78641</SHA-256>
              <SHA-1>c1b0bead9824329797505781622e2ec7d4347361</SHA-1>
              <MD5>fff7c04a1162764a276b3b887574fde4</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>807ecfe6b0bdb93f45cd8aceebcd2844c14a03d1fabebbf8d3a2da3248900776</SHA-256>
              <SHA-1>3712e2e23a1ced4f07297e05a827e460315f338b</SHA-1>
              <MD5>fbc848a16f7032a08d7fd846e821fd5b</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>InstallerClean-2.3.0-portable.exe</name>
        <report_id>54d11090-5ce0-4555-aa15-5e7fa74de4c8</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>packed</value>
          <value>anti-debug</value>
          <value>overlay</value>
          <value>dotnet</value>
          <value>fingerprint</value>
          <value>lolbin</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>46e8d2bd454926641176ea67b2e357089ff411c89e524def0158a04b6103d7d4</id>
    <title>Analysis Report for 46e8d2bd454926641176ea67b2e357089ff411c89e524def0158a04b6103d7d4</title>
    <updated>2026-10-05T10:59:19Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3833dd130e7ad452672ff</_id>
        <file_type>text/javascript</file_type>
        <flow_id>6ac3830582bbdce1c8b06012</flow_id>
        <hash>46e8d2bd454926641176ea67b2e357089ff411c89e524def0158a04b6103d7d4</hash>
        <iocs>
          <urls>
            <value>
              <url>http://luajit.org/</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>luajit.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>163.172.177.144</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>2df88c5e3730d5a1cca00fbd1a2d28e594de3b80fb305e1e3a01295e287da6be</SHA-256>
              <SHA-1>b9270c4f613e3becea0a5a6352971df2fc6a3c09</SHA-1>
              <MD5>ebf698f98023235e8ad24fcea7cef77e</MD5>
              <origin>JAVASCRIPT_EMULATION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>3e713dea7fe1769c36d25fc57d27b898dbd49fa1b5f72494f9f3748f173f822f</SHA-256>
              <SHA-1>e0147b872d86eb47144b7e12e8af5f74f289e444</SHA-1>
              <MD5>fc30b0920ac617bab35b75bcb6e51ada</MD5>
              <origin>JAVASCRIPT_EMULATION</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>a73f26a8d504043f785d7360e8febf2eeb8522ec873a0d4dd5d1d4bfd1e67d3d</SHA-256>
              <SHA-1>6c93b8c5fde8be4b2231dca6b8ec513cdc82c991</SHA-1>
              <MD5>5aa04ce935e78505e230765e85c34355</MD5>
              <origin>JAVASCRIPT_EMULATION</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49</SHA-256>
              <SHA-1>145c72f8acdcd366869f955dffd000d3bc146b6e</SHA-1>
              <MD5>7675b38aabebc8427171447edd484b5b</MD5>
              <origin>JAVASCRIPT_EMULATION</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>a21855da08cb102d1d217c53dc5824a3a795c1c1a44e971bf01ab9da3a2acbbf</SHA-256>
              <SHA-1>b4c96d80854dd27e76d8cc9e21960eebda52e962</SHA-1>
              <MD5>a3f390d88e4c41f2747bfa2f1b5f87db</MD5>
              <origin>VBA_EMULATION</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>66c50d2a5ba0a96d30be3d64fcdf344912799375fcd093735824af43ab991e87</SHA-256>
              <SHA-1>3212975408dc753eaa6ceff270a107fafc862aeb</SHA-1>
              <MD5>f853f444a788183296e243a0af587288</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>180SW_2828-501.JS</name>
        <report_id>fba40bfc-ad43-472b-8b32-a014e78fb7f0</report_id>
        <tags>
          <value>javascript</value>
          <value>html</value>
          <value>obfuscated</value>
          <value>dropper</value>
          <value>evasive</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>ai-born</value>
          <value>llm-interaction</value>
          <value>repaired</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e000b6ed57da48da099dff02a9fbef8eea9fd0c4ed0abdf6f7dc2ce2826cf9ae</id>
    <title>Analysis Report for e000b6ed57da48da099dff02a9fbef8eea9fd0c4ed0abdf6f7dc2ce2826cf9ae</title>
    <updated>2026-10-05T10:58:06Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac382c5d130e7ad452672dd</_id>
        <file_type>text/plain</file_type>
        <flow_id>6ac382bcdedbc9646d41a199</flow_id>
        <hash>e000b6ed57da48da099dff02a9fbef8eea9fd0c4ed0abdf6f7dc2ce2826cf9ae</hash>
        <iocs/>
        <name>9968168_434ce5f6-9394-4f83-8e8d-9ff11ff0a4ec@9968168</name>
        <report_id>42483e8c-c175-4f85-b86f-f3d480593912</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>07b11065e12dfe1c95f58ac46d14e1f1f6f9477c97eef341a7707f95efbc1e62</id>
    <title>Analysis Report for 07b11065e12dfe1c95f58ac46d14e1f1f6f9477c97eef341a7707f95efbc1e62</title>
    <updated>2026-10-05T10:56:42Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac382b2d130e7ad452672d7</_id>
        <file_type>text/html</file_type>
        <flow_id>6ac3826936412e623d2c4c64</flow_id>
        <hash>07b11065e12dfe1c95f58ac46d14e1f1f6f9477c97eef341a7707f95efbc1e62</hash>
        <iocs>
          <urls>
            <value>
              <url>https://api-test.klara-epost.tech/docs</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
        </iocs>
        <name>hxxps://api-test.klara-epost.tech/docs</name>
        <report_id>8f18c46e-0e37-4348-9f01-af4096433fad</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>64b367c43d9204766a60836be1599fe3c48987d4412c26da3a96df034a8d970c</id>
    <title>Analysis Report for 64b367c43d9204766a60836be1599fe3c48987d4412c26da3a96df034a8d970c</title>
    <updated>2026-10-05T10:55:11Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3823bd130e7ad452672b7</_id>
        <file_type>application/x-msdownload; format=pe64</file_type>
        <flow_id>6ac3820ecd19289b120c2870</flow_id>
        <hash>64b367c43d9204766a60836be1599fe3c48987d4412c26da3a96df034a8d970c</hash>
        <iocs>
          <ips>
            <value>
              <ip>5.1.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>0a7fd0f5026536a71058f08c27dcc41c6c683150923e37e712b732957edff2a7</SHA-256>
              <SHA-1>fd24cb1ca987a944519de56f9707490ca9c5745e</SHA-1>
              <MD5>6b274c45e2625e375b4ec57e6925de06</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>10ff67622b19c3f3d0a0d056ac870cf3eccd79176f06e12e0fcb4328a9f06a19</SHA-256>
              <SHA-1>a35b29a91e2b072ad902285ed9dea86d5d491ab9</SHA-1>
              <MD5>ba0989b41fc0be97e40042573abb7ba7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>416bfd9ea83f3245ac7fe4938f42215df1c87456a683fd44061310f2c75ff259</SHA-256>
              <SHA-1>561ebd0ffd3b0de6ab9b58191a4fd6142eca1d44</SHA-1>
              <MD5>2b0579cb5b0956aa92b0f608b96cd443</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>4dd7c594b66fe7957b56324e81a9508c986b045cd4f47f6a376ed8c88167b07f</SHA-256>
              <SHA-1>24650869abd9b5ec23ef27983a4af1ca14f9d57c</SHA-1>
              <MD5>78bc621f06748069b2c163cb0571262b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>4f7be4f8132e6a05f2d2df1d2e883e8bbc9abf9deebfff03ef95caec2d1574ad</SHA-256>
              <SHA-1>231bcef19bec25827606c587304b2d0c59bba029</SHA-1>
              <MD5>11392b8d033615890a8a1c2770c80b64</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>4fd9c1064d438c15ca933202f65a5121a6a6521729417a363471f55e17053a16</SHA-256>
              <SHA-1>fdd8d8aeaae75ed680280ac9ac3a51f1576c150d</SHA-1>
              <MD5>d76b0b5a146d0d1509b0ff2747fe440e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>6acd21b9a6ef5b3e62fb7a1aedb2ab722697bd14914b91d24f1abf533f98143e</SHA-256>
              <SHA-1>f461f7380c8dafcf3545b646f40b39a6b9c7de61</SHA-1>
              <MD5>2ac784a32bb176b22b090da9302ef1d4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>7516ca3750a141c39ff585908cde764b8da347e32a6df6c55efa22bec5f42442</SHA-256>
              <SHA-1>cf2f7d9e3acfcc93a3fe6a2c24ce73c2f9d670ff</SHA-1>
              <MD5>8d6b275c28653effb8d98f04912bb08b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>83c09d35f8a36ca410c832b53a8843624c278379729c1823b0183441c15be8b6</SHA-256>
              <SHA-1>e0dd9330d3f1e6aac5447805111adbfe643c6950</SHA-1>
              <MD5>c26de53be06e7d7871ff612048b57868</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>a678afb31e10b66957db1b572de75d00cbec3ca89ada86561b8b948d613b1bfe</SHA-256>
              <SHA-1>a52eb70db6d83ada16cfa6c072ff76a42d6512c8</SHA-1>
              <MD5>a77a7aef28b34bee7f945cc7be039d47</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>a69ff037ef0b03fb051f14035f5e230c232f4a65e5b5fc5b34a6b5e4161b434d</SHA-256>
              <SHA-1>9693c3aa604821be0dc9c067b4f1cb2fedb6f571</SHA-1>
              <MD5>689148b85d8367346836aa889bb4fd65</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>aa4b54539a349814083f20f0b66d3f41715425b39e6bf2e402be202dffe8f0ca</SHA-256>
              <SHA-1>40aaa62065f9051c1894375e05fa4c3281c7fdee</SHA-1>
              <MD5>024136a91811ab0c5825f5dc6648abf6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>ae1f8c2870a451f1862c6376c2d2a7e7f4ec32aae72e7d63fe7d36bdc1886784</SHA-256>
              <SHA-1>74aa8e9dc28c98c24d4c7f2319f2157c9862956b</SHA-1>
              <MD5>d9b070e9379dc5cc0f0ce3c363101368</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>be04b731901aa71e86d801a6854aadbc7c1716a2112a8c25d56089cb0938430e</SHA-256>
              <SHA-1>6b8731f17b58114a747dc0661cac07a861c017a3</SHA-1>
              <MD5>437f4e33decef8e67f5fd24351995170</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>bfb99f8e377f874b54b57f3e09f06736d25fa07e938a6a27a3d4fbd0396020dc</SHA-256>
              <SHA-1>87ef2496fdce0a5fe8fe8a817dd9c27679ee4e75</SHA-1>
              <MD5>fc4e2278ca1d886f9efdf939caac927c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>d7d7558215a22f131db451ffaae0d31e2c131bd3a65ba350b28f2d77e189df5b</SHA-256>
              <SHA-1>7501abd895875c3612923815389b7ea9cbea4d48</SHA-1>
              <MD5>a4a4134831580795fbb659094a964495</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>d81df843d4f894cff260fa7675389a9aa37d2573fdb5618d34dd573df1e56d54</SHA-256>
              <SHA-1>6b428d7b36f4afc4e76d706a95516d9b68082e3b</SHA-1>
              <MD5>9aa33cd71279725d964b742f9d773256</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>dcaf12443d0ac3ce331b80ca9ec1c4e26fcffcf23fa3003b59d7addb2d20f171</SHA-256>
              <SHA-1>0df603538bd8ebe62b5c8c16dda680c5d76b189c</SHA-1>
              <MD5>7efff71dddf124ea8d41367578b57397</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>ea3ef4cfbdb31fc2bbd9d4a36cc13e625b82b31ec690c903c8fb6a566db65075</SHA-256>
              <SHA-1>92ecbe774d3273258eb6617991a02b33465fe4fe</SHA-1>
              <MD5>c15b38ed073db2209071dab34b27d7bb</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
          </files>
          <registry>
            <value>
              <registry>SYSTEM\CurrentControlSet\Control\ConKbd</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows NT\CurrentVersion\Console\TrueTypeFont</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>conhost.exe</name>
        <report_id>dbc980b3-53a3-4b03-8ad1-563138868fa7</report_id>
        <tags>
          <value>peexe</value>
          <value>evasive</value>
          <value>masquerade</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>anti-vm</value>
          <value>cmd</value>
          <value>lolbin</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>68737633dd4101ab8081df430155c8ce79f908992fcd8abfbac881b4652730ff</id>
    <title>Analysis Report for 68737633dd4101ab8081df430155c8ce79f908992fcd8abfbac881b4652730ff</title>
    <updated>2026-10-05T10:54:47Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac3820ad130e7ad452672a8</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac381f6dedbc9646d4185b5</flow_id>
        <hash>68737633dd4101ab8081df430155c8ce79f908992fcd8abfbac881b4652730ff</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>0f21d2fdac26c3ccf1951fbf9af680671ccece507eff68d703403c6e4b901d2f</SHA-256>
              <SHA-1>fcec0379ba9b68e61af8393572555b2e9c5946a5</SHA-1>
              <MD5>244cb4386b4a018a1c71b2e89d11928a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>3981d57a8a2762c25a135084771985cfe6a9914dc99b91a632308867d7dd01da</SHA-256>
              <SHA-1>826240a1926426be784e5b4faab624163e9e1c3d</SHA-1>
              <MD5>cdfb853306a1080d2a46f8a2e97c21a8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>449f76f684fdf9b4571e721239b8206b91c2e6b1ac0c92f2be71b0278fb09e07</SHA-256>
              <SHA-1>0cb0d5a69be2c292b0e1af1d6e468e7af673143b</SHA-1>
              <MD5>67a22c88389e99b7cacc3a762d14f70e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>4675ff75ca5a51654acfbbbe837cbf71d4292012d2571cb5e366a6f2d1ae5013</SHA-256>
              <SHA-1>42510e4f17411d1a764d160b853a171849746cff</SHA-1>
              <MD5>9d90689bad88ab72e3655ff9803f95b8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>621f3e2ab45b24c23a2c3130ad6f26fb61069e676110f0dfd68ceeae7d7b6d49</SHA-256>
              <SHA-1>3486f8ce21a58a88f3d0a255ffa59f9b2cfc9e16</SHA-1>
              <MD5>313d96937dd97c0b686f36a84b7f3ea0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>8ef642f00187b07c6b022cc7d94a8fef6c8604428915db936f77751d64631276</SHA-256>
              <SHA-1>63b2fdc5a3f8b8da73455a7d228f5a4c936994db</SHA-1>
              <MD5>2a1e50e7b71359183e0bbf8fe49fba59</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>94fce7d35b768505fb22bfeb8c799f140df9601be44547336336ba2ee0f5bd3b</SHA-256>
              <SHA-1>31b132401b56ad5593f363f8db9a83a87338f8cf</SHA-1>
              <MD5>2b5dc94d14ec04684fc4b2d91d9d3757</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>a1686a9d50baad70a5658e0a2cb38a34f7c96fa41f5beebb81bcf405355b712f</SHA-256>
              <SHA-1>e94b851c8cbdb0d8c436a7f7ff2f81ce562f0842</SHA-1>
              <MD5>a5eb3ed91e9fbbee892ab6d6a717a9a5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>a9727684108f25c282dbdbae639562e2a7b61be4bd019458d017cb52b3e732cc</SHA-256>
              <SHA-1>a899adb6b1b7ee5c5f8e08063a34a95bcf1e44b5</SHA-1>
              <MD5>6fd31afdd4a777d17e496f473252448a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>ca20126f0133807e50d39f1348a5fc400064e167dff808aa165f79bc8a81c22c</SHA-256>
              <SHA-1>1db8a65c81d09b9b3e88789a8f74f3b853ca8614</SHA-1>
              <MD5>ef4a1cc64fac0b612f3f25d47c31873c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>edabbebee249b60387c6558e2befde49e987decce4ee254c0b1f04443b8f1efd</SHA-256>
              <SHA-1>7c8ed7682892fe91252ca02aa9bfa656ca412d9c</SHA-1>
              <MD5>d80f4c59bc6e8dbe618d52144ad15d24</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>fe3cff0caad7c2d1f50ea2f3b29c659ee87b532abff8373ce638f2bfbcd9687a</SHA-256>
              <SHA-1>3be353bdfcb739efd6d47f3b826f21a6c12da515</SHA-1>
              <MD5>a4ef2ec47b67e22f1e8c284eaaaa9dd2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
          </files>
        </iocs>
        <name>xenia.exe</name>
        <report_id>abc43f52-cdd4-44f7-bfd0-13a7a6dd7eef</report_id>
        <tags>
          <value>peexe</value>
          <value>keylogger</value>
          <value>anti-vm</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>7810f3902f4918b1af7a836f85a6afb1173e0ecff258c06cee9dd37aba359839</id>
    <title>Analysis Report for 7810f3902f4918b1af7a836f85a6afb1173e0ecff258c06cee9dd37aba359839</title>
    <updated>2026-10-05T10:54:38Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac38204d130e7ad452672a7</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6ac381ec12611a5e16d4087a</flow_id>
        <hash>7810f3902f4918b1af7a836f85a6afb1173e0ecff258c06cee9dd37aba359839</hash>
        <iocs>
          <urls>
            <value>
              <url>file:///tmp/tmpuls3kuim.html</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <ips>
            <value>
              <ip>23.172.112.203</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>15f96f99d77cc7d709e3019870e6863745bfc740a8b47623e8e6a503fc3fce8d</SHA-256>
              <SHA-1>03a9fe9846da2d0d726b9d9e3e1e1f3f0b26d031</SHA-1>
              <MD5>9dd2616e2b777b7a34fd0fd470532dea</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/html</file_type>
            </value>
          </files>
        </iocs>
        <name>submission.eml</name>
        <report_id>04592048-aa03-43ca-93da-7ae79aacbe98</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>1fe8d2e0da5acea8829eb96fcf65e8b7efa4f03a5eff53ffae15469de6c9a22b</id>
    <title>Analysis Report for 1fe8d2e0da5acea8829eb96fcf65e8b7efa4f03a5eff53ffae15469de6c9a22b</title>
    <updated>2026-10-05T10:53:40Z</updated>
    <content type="application/xml">
      <details>
        <_id>6ac381fed130e7ad452672a2</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6ac381b2dc75a6ac83325160</flow_id>
        <hash>1fe8d2e0da5acea8829eb96fcf65e8b7efa4f03a5eff53ffae15469de6c9a22b</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>11328d62054bf014f8db80e41bad0689d5c7f8467561d4e285ad81103d8374fd</SHA-256>
              <SHA-1>1a164f2e8faf8c2c04bd559e781019bff86c8e88</SHA-1>
              <MD5>7fe4388ad26a7b4c0b24a13da17811b6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>1ec916738793d8b606aea67fac6a75476af40c793a9a278b32b56a52bdcbed14</SHA-256>
              <SHA-1>aaf2ba9876ffe162f4ae03c9eab01f02b41c4292</SHA-1>
              <MD5>a85d8ca3e27bb01b87b11f893ef2080d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>2c054e3d134fae3fb75bf5e51d73bbff08f34b5caaa1fced83d8dbe450ffe84d</SHA-256>
              <SHA-1>16706ad1730ea34f68f95019465bc899cf3dacc4</SHA-1>
              <MD5>373b624609854398feda4869a4686d6d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>2deeea2ef6cc964142390d28e9e6d9a0eadb0600ca385731125d18f6f13f4260</SHA-256>
              <SHA-1>333a0f4ed673f04d8457cedf9db6bf6853cae37a</SHA-1>
              <MD5>6adfa1758da6650a3a722f3091dd5a24</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>48b99bd54b2fd532ef2a2319f0c72506381d8bdb8eb782ced9d668aba31a9817</SHA-256>
              <SHA-1>f58d98419639fc7fd878bdef276c05a76b436990</SHA-1>
              <MD5>0b18f8da8dfbb1ed079c0d323ec53a3c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>51165de4fc0c2b58125a14d96961d87827f741f1feb5b6abc59ba1e6b4d260d9</SHA-256>
              <SHA-1>70f128e6499de76d119d84285e8829a7b32cd63e</SHA-1>
              <MD5>57855475d891aa2ba5429bb9717ae039</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>586f6ac13d8598709d802b5e145d1f413901f54160c24ec6dbcf8014cb1cb54c</SHA-256>
              <SHA-1>2d9815ca7dda3cecc1621449dd4c9c540318d212</SHA-1>
              <MD5>a7073ab40320e6f7efd0ddfb176b6864</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>5ca472be428c525c81a50e8937f391d6e4c7d18178ced89b6e5b03fe58339077</SHA-256>
              <SHA-1>6ff7cc4acb1494a79da1cc28afdbcda95703417f</SHA-1>
              <MD5>a3cac847a8b156edd23f924c1b525a3a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>619752d20beaa1f07e843cf734bf6a5a8d71851911189935a188f4de71e95d7a</SHA-256>
              <SHA-1>18f7ab2c3603aba873210558e8568950acc1b005</SHA-1>
              <MD5>2a776e395615c185a9519ece7af7f5ff</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>619892660ddd3dc2dcf9311ba76faf05c38f8b2f868e574b93271867133c6793</SHA-256>
              <SHA-1>1050ddbdd96fb4da98cd6f9562ee1475c4c6b6ef</SHA-1>
              <MD5>b0d8c1766feb0c6167d92aa2fb386a39</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>6863768434318da7e8fcd901a61c350bc294eb138b819f1b78db1b480c536b1b</SHA-256>
              <SHA-1>a4175f96ac4ac2b1fa9ac8f6bab5850a0c619770</SHA-1>
              <MD5>96bb6ae5dfc88ebd176b3507dbdc2bef</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>743180184d0ebcc498f112c36845909496a1048793ba392294ef4660acfa9a08</SHA-256>
              <SHA-1>25fdfa5ac932991fd905efc86a19978b27438406</SHA-1>
              <MD5>32cdebd6d37b8635384021f810a2b3b7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>789564f0202c4b765cf3286219116765da9a6f06b7bc4db8b335b5e1fefd81a8</SHA-256>
              <SHA-1>c83e0aeb71593dd6b75680445023c4140804f0bb</SHA-1>
              <MD5>1a8625f5c6e37d4c2e470b357c83ef85</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>7fd5dabcbd26bace37454ffcd62bfd25db084f6cca247a2cb5276ccc4debeac4</SHA-256>
              <SHA-1>4f3b4e80ef540f3c14702f63d3cb16c5d587ea9c</SHA-1>
              <MD5>fc0398ff8df2f323c22b04d8e724ec67</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>83866f9bb008354cf7ca488c75ba95887f65f70ee4034b5b9da03e0b9decf54d</SHA-256>
              <SHA-1>b40861ea97c642f150f88ff51bd8d073e390cef4</SHA-1>
              <MD5>e371ddb0f084f53b2a83ec1613137ead</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
          </files>
        </iocs>
        <name>lghub_agent.exe</name>
        <report_id>1682f7c1-3ebf-4b44-9313-a18deef4713d</report_id>
        <tags>
          <value>peexe</value>
          <value>fingerprint</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>crypto</value>
          <value>keylogger</value>
          <value>reconnaissance</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
</feed>
