<?xml version='1.0' encoding='UTF-8'?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
  <id>1ff13549c574486f9693436d673da621</id>
  <title>www.filescan.io feed</title>
  <updated>2026-08-20T23:38:42Z</updated>
  <author>
    <name>Filescan.io</name>
    <email>admin@filescan.io</email>
  </author>
  <link href="https://www.filescan.io"/>
  <generator>Filescan.io feed generator</generator>
  <logo>https://www.filescan.io/assets/logo.png</logo>
  <entry>
    <id>640863b61ca0c688e82a0690eefa6009735f42a50dc6d3557b3e55201f1a5c6b</id>
    <title>Analysis Report for 640863b61ca0c688e82a0690eefa6009735f42a50dc6d3557b3e55201f1a5c6b</title>
    <updated>2026-08-20T23:36:32Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878fa1f2677ae4d366dc31</_id>
        <file_type>application/x-object</file_type>
        <flow_id>6a878f7ff21817d7f9087ff0</flow_id>
        <hash>640863b61ca0c688e82a0690eefa6009735f42a50dc6d3557b3e55201f1a5c6b</hash>
        <iocs>
          <urls>
            <value>
              <url>http://192.168.0.95</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <ips>
            <value>
              <ip>192.168.0.95</ip>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </ips>
        </iocs>
        <name>1.bin</name>
        <report_id>16d2566c-0570-4ed4-88bd-2ae9957f77fc</report_id>
        <tags>
          <value>elf</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f30ba539b2ebc4c78c6d2bbfe73801b75d7469f1d7fbab297366d68f23b666f4</id>
    <title>Analysis Report for f30ba539b2ebc4c78c6d2bbfe73801b75d7469f1d7fbab297366d68f23b666f4</title>
    <updated>2026-08-20T23:35:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878f62f2677ae4d366dc25</_id>
        <file_type>text/x-shellscript</file_type>
        <flow_id>6a878f40befbfb13af7f25c2</flow_id>
        <hash>f30ba539b2ebc4c78c6d2bbfe73801b75d7469f1d7fbab297366d68f23b666f4</hash>
        <iocs>
          <urls>
            <value>
              <url>http://192.168.0.95</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <ips>
            <value>
              <ip>192.168.0.95</ip>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </ips>
        </iocs>
        <name>1.bash</name>
        <report_id>e9aa0a00-75d6-4451-9300-2d65cc281736</report_id>
        <tags>
          <value>shell</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>facb9710618ef1dd86c19985e315e5ecdee8010b951ffc017154bbb7ebd7b337</id>
    <title>Analysis Report for facb9710618ef1dd86c19985e315e5ecdee8010b951ffc017154bbb7ebd7b337</title>
    <updated>2026-08-20T23:30:05Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878e0ef2677ae4d366dbdc</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6a878dfbe2a9f641177b6194</flow_id>
        <hash>facb9710618ef1dd86c19985e315e5ecdee8010b951ffc017154bbb7ebd7b337</hash>
        <iocs>
          <urls>
            <value>
              <url>file:///tmp/tmpr5je8s5q.html</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <files>
            <value>
              <SHA-256>d0b48c720d1712a63b8d4b2830b25cf6b447465947042bf382d6fca312443730</SHA-256>
              <SHA-1>ba8be54055a80fb209789143075d6c467c313cae</SHA-1>
              <MD5>2ce05521429e42895487eca3cda6e4a1</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/plain</file_type>
            </value>
          </files>
        </iocs>
        <name>submission.eml</name>
        <report_id>385e0c5c-fb1e-4c29-b852-efba333914bf</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>2cece703b79a98f1834334d9e7d31fbe2088b2d017f7fe591affebdc18e2f92d</id>
    <title>Analysis Report for 2cece703b79a98f1834334d9e7d31fbe2088b2d017f7fe591affebdc18e2f92d</title>
    <updated>2026-08-20T23:28:22Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878da3f2677ae4d366dbc7</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a878d94f21817d7f9087cc6</flow_id>
        <hash>2cece703b79a98f1834334d9e7d31fbe2088b2d017f7fe591affebdc18e2f92d</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schemas.microsoft.com/SMI/2005/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/SMI/2016/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>00f587802e943847c7f5bf0e574f6bd1221acdac2209e5d10436da4376bc0dcf</SHA-256>
              <SHA-1>48637dedda49bab4a1629ccd376a341d8a1182d6</SHA-1>
              <MD5>9944bcc412f623dd81045875a0d14b3a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>0856bcf2dae8388683a70f1772b4349dda495ba590a107e1dc3f7c6ad15d5162</SHA-256>
              <SHA-1>5eef9a2e8ca67187464652bd58868c41e1c3f5eb</SHA-1>
              <MD5>c3b694ead96a6d913f9ef7b987ceca81</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>2981aee1226a9c60bbbca072503118b1d9fc474fd9a82a6d92c68037f5a12747</SHA-256>
              <SHA-1>46cbc79d0b8e72b9af47d5f196793d5ab812f032</SHA-1>
              <MD5>48aae5da6bea3bd1a899444ddf801eb6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>2a87b1f32c5d0435090c72c392b75394f706e5750eff64fd85d25e1c622ee581</SHA-256>
              <SHA-1>52ca961fd37ad960905a681d1db5157508ef1602</SHA-1>
              <MD5>3bf2dac037ce87794e66ff7f054e913f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>360d579dbd14759b41afdf7fb5e80c0101e15150ae401d59f92a1e32d129f7cb</SHA-256>
              <SHA-1>639ac5cdf8a5cf3245975932c6a4215450a7b98f</SHA-1>
              <MD5>5fb38429d5d77768867c76dcbdb35194</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>4ddc2bddcf1089ce8b59ed162ec10f6481e61be7f6b441bb03f8e19e273dc570</SHA-256>
              <SHA-1>5ca54ca5f47dd280d1e1c177e1c840cef3df60dd</SHA-1>
              <MD5>6a592acb2dbc328273d2835286183aab</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>5feead64ecd09578217e39a59d66f0481c3273d588edc0a6ac2a2b114e96dcde</SHA-256>
              <SHA-1>9d5918f921d98130ebaaa5e5402a6ca2bfea141b</SHA-1>
              <MD5>85048e0cea541093b6c02537f439b2c7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>616ba199afe7f9bc56c609aeebeb350b1520d3a5c0d22cb5c8b548805a1d0b37</SHA-256>
              <SHA-1>d524b2a3e59b8a13e4aad013ac2e3f3606790cba</SHA-1>
              <MD5>7bba3cae9d712afaa5fbdba5a3b82c96</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>8ebbf41a24a20004a6f7a08803b7e836b34fbf959d244677cb77c8557b51a4d4</SHA-256>
              <SHA-1>07918fe64ac24243ec20648efe965e22bfc5e641</SHA-1>
              <MD5>4c9097abf42dcc8fa73759100be4918b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>93cbdc457d46a325778ef626a5e3fee069583a8bc6fdcfa9fc6ec8a5c43aec25</SHA-256>
              <SHA-1>28904077db19dee2da4475c11edc5d370fcbafa4</SHA-1>
              <MD5>d8d101900118a09bedce93d9d402260e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>9dbf14d95f863310a6a7273c40eb93c1ec4163f9e43984c54cc5c6ee3558da4e</SHA-256>
              <SHA-1>ce30dfb361b76f0da885e574d1141a4c1df9d382</SHA-1>
              <MD5>9058ddfc11f6fb386c1f00a913a075d2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>a3b09818ba1581596d675f2525f4471109de3fdf7df7d73b9bec4631f635cd8a</SHA-256>
              <SHA-1>90581891c82cdbc923de8abaead73e059e0bd506</SHA-1>
              <MD5>5e498d081560ad478c692fb8fbfcfb7d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>b1b571a6ade39f525dba4d078b84331cffe44622db676e775647e79d5fd85f37</SHA-256>
              <SHA-1>8df878fc2c461ea0dfd2bf44ef7b1b58199895d4</SHA-1>
              <MD5>e85ef377f1b9da5cfc978f81033ca35d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>b7669a23c57e1c954caa36dc5dd4c56689c7281c968172ac354c40f030434453</SHA-256>
              <SHA-1>bf229daaade5135cd3d4e3b872099e1adb7f883b</SHA-1>
              <MD5>6fb6f0d4ad0b7f4342e76f4b0461aaab</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>cad086d1f188a4d72f25682252b36fa4f8ee68817229a3efb37524061bd06dd3</SHA-256>
              <SHA-1>80d6b568b18b724579c44f0493892d5b60cfc415</SHA-1>
              <MD5>6fa77f542664a14f625264fe0c94910a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>d31a3ce6768b10466f2609da44a0e09eeba06df7767bb4fb892eb6be8c8b5fb7</SHA-256>
              <SHA-1>1d73e0cf5040b8fde5537e69e0f0bf887c2dcf6d</SHA-1>
              <MD5>4db56d705d5e3175d8101761cabae789</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>d3e3d827d213eb9494c2753468ad4dab35f3969a68629bd41678c7d5e35cb4df</SHA-256>
              <SHA-1>1b0fdcff2f25d30c09fe3c257161cd5299e9d680</SHA-1>
              <MD5>976202076f8a8cb3103c9f7f125d88ff</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>e4f882b77c03ff8485d2dfe6fdddbace29e89bb5ac60be176cd82111cadcc1c9</SHA-256>
              <SHA-1>b793571bd220bafb6e6ea6793714a8773255d969</SHA-1>
              <MD5>8623a033f11d21568b410c18abcbb603</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>f23cd1a29715e907a6fede8f850d18c62db4c2d61ba469e030685f17f472e836</SHA-256>
              <SHA-1>f8f0c05ddcb47dce766c61804fbec4609f1c3f93</SHA-1>
              <MD5>277ba4f9439108894d7f921878249383</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>f42e14e74332e017b0195e47e2ece5c45c3e8e0e0ecc5771b0c553dd3fdb4a04</SHA-256>
              <SHA-1>bad4be2e7c7076730da9d5013bacb44976a0d2e0</SHA-1>
              <MD5>79d2cb1ba9b9782c2fbf0ce22618f87b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>Iron Nest Heavy Turret Simulator.exe</name>
        <report_id>801510d8-d342-48a4-9e4b-2764057199d0</report_id>
        <tags>
          <value>peexe</value>
          <value>adaptive-context</value>
          <value>packed</value>
          <value>overlay</value>
          <value>microsoft_visual_cc</value>
          <value>anti-debug</value>
          <value>anti-vm</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>88705db92014be761298046d0bf85c131fdcec5c17a834f562649546711a53fa</id>
    <title>Analysis Report for 88705db92014be761298046d0bf85c131fdcec5c17a834f562649546711a53fa</title>
    <updated>2026-08-20T23:27:50Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878d8df2677ae4d366dbc1</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a878d74b107fd4d6e902c4b</flow_id>
        <hash>88705db92014be761298046d0bf85c131fdcec5c17a834f562649546711a53fa</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>7af7bb769fd476f0a8c5e3e6dc9a03acb6adf476e79c3a1a9d85f3ebb73ddc6d</SHA-256>
              <SHA-1>2336f48255b9ea091d85a52f91be0c3a4694b539</SHA-1>
              <MD5>702b38c30d0b781523c261e0aa052c42</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
          </files>
        </iocs>
        <name>Hysteria.exe</name>
        <report_id>9899342f-87d1-464f-88f0-d7850afed940</report_id>
        <tags>
          <value>peexe</value>
          <value>packed</value>
          <value>crypto</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>b3cb247a4848f22cabf9058dd27e73fe4f575a2906ff296b5920b0e9f1bb5971</id>
    <title>Analysis Report for b3cb247a4848f22cabf9058dd27e73fe4f575a2906ff296b5920b0e9f1bb5971</title>
    <updated>2026-08-20T23:27:16Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878d6bf2677ae4d366dbba</_id>
        <file_type>application/x-msdownload; format=pe64</file_type>
        <flow_id>6a878d51befbfb13af7f2132</flow_id>
        <hash>b3cb247a4848f22cabf9058dd27e73fe4f575a2906ff296b5920b0e9f1bb5971</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>6a37539284d84a7131d983be2d3df6d7df5bccb39705216096d1bacbcee27b01</SHA-256>
              <SHA-1>21049da36c50000cc9f1c5db290f96125c82de06</SHA-1>
              <MD5>1974fcd3138616d6148f431a1c3f13d4</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/x-msdownload; format=pe64</file_type>
            </value>
          </files>
        </iocs>
        <name>b3cb247a4848f22cabf9058dd27e73fe4f575a2906ff296b5920b0e9f1bb5971.exe</name>
        <report_id>d16f937f-15a1-4f0b-9a49-057388a6da07</report_id>
        <tags>
          <value>peexe</value>
          <value>packed</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>beba7c1ffaf0f8a3c79c51f393116123f1d165ac15299988970d3c1093278c63</id>
    <title>Analysis Report for beba7c1ffaf0f8a3c79c51f393116123f1d165ac15299988970d3c1093278c63</title>
    <updated>2026-08-20T23:26:10Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878d2149c2438a47b72f21</_id>
        <file_type>text/html</file_type>
        <flow_id>6a878d11eeadd95beca18601</flow_id>
        <hash>beba7c1ffaf0f8a3c79c51f393116123f1d165ac15299988970d3c1093278c63</hash>
        <iocs>
          <urls>
            <value>
              <url>https://parisgid.top/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://parisgid.top/besplatnye-muzei-parizha/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/bloshinye-rynki-parizha/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/bulonskij-les-i-parki-parizha/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/cafe-de-flore-i-sen-zhermen/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/chayevye-vo-francii-i-parizhe/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/karta-okrugov-parizha/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/luvr-chto-posmotret/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/metro-parizha-nochyu-i-rer/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/mulen-ruzh-i-vechernij-monmartr/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/muzej-massena-nicca/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/muzej-orse-bez-suetny/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/rayony-parizha-bezopasnost/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/ruanskij-sobor-i-den-v-ruane/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/strasburgskij-sobor/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/versal-iz-parizha-kak-dobratsya/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://parisgid.top/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>parisgid.top</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
        </iocs>
        <name>hxxps://parisgid.top/</name>
        <report_id>d348ee64-de2c-41c5-8330-d5be9e2b70f4</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>beba7c1ffaf0f8a3c79c51f393116123f1d165ac15299988970d3c1093278c63</id>
    <title>Analysis Report for beba7c1ffaf0f8a3c79c51f393116123f1d165ac15299988970d3c1093278c63</title>
    <updated>2026-08-20T23:26:06Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878d1f49c2438a47b72f20</_id>
        <file_type>text/html</file_type>
        <flow_id>6a878d0cb107fd4d6e902bec</flow_id>
        <hash>beba7c1ffaf0f8a3c79c51f393116123f1d165ac15299988970d3c1093278c63</hash>
        <iocs>
          <urls>
            <value>
              <url>https://parisgid.top/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://parisgid.top/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://parisgid.top/besplatnye-muzei-parizha/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/bloshinye-rynki-parizha/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/bulonskij-les-i-parki-parizha/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/cafe-de-flore-i-sen-zhermen/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/chayevye-vo-francii-i-parizhe/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/karta-okrugov-parizha/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/luvr-chto-posmotret/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/metro-parizha-nochyu-i-rer/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/mulen-ruzh-i-vechernij-monmartr/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/muzej-massena-nicca/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/muzej-orse-bez-suetny/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/rayony-parizha-bezopasnost/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/ruanskij-sobor-i-den-v-ruane/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/strasburgskij-sobor/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://parisgid.top/versal-iz-parizha-kak-dobratsya/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>parisgid.top</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
        </iocs>
        <name>hxxps://parisgid.top/</name>
        <report_id>75b83841-9a8f-431a-bcfb-d26107d3f2de</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e9f4917373b52392e7a1e44513e42f711571c709a5343e60e223759a41f1b561</id>
    <title>Analysis Report for e9f4917373b52392e7a1e44513e42f711571c709a5343e60e223759a41f1b561</title>
    <updated>2026-08-20T23:25:54Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878d1049c2438a47b72f1d</_id>
        <file_type>text/html</file_type>
        <flow_id>6a878d00befbfb13af7f2073</flow_id>
        <hash>e9f4917373b52392e7a1e44513e42f711571c709a5343e60e223759a41f1b561</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/comment.php</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://it.wordpress.org/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/comment.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/js/password-strength-meter.min.js?ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/js/user-profile.min.js?ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/load-scripts.php?c=0&amp;load%5Bchunk_0%5D=clipboard</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/load-styles.php?c=0&amp;dir=ltr&amp;load%5Bchunk_0%5D=dashicons,buttons,forms,l10n,wp-base-styles,wp-tooltip,login&amp;ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/dist/a11y.min.js?ver=31c6cec5a4ff7aff483d</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/dist/dom-ready.min.js?ver=3fe927cab37bf38d6a23</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/dist/i18n.min.js?ver=1dfe7db3940c23ea9216</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/underscore.min.js?ver=1.13.8</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/wp-tooltip.js?ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/wp-util.min.js?ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/zxcvbn.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-login.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-login.php?action=lostpassword</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>innovationprocurement.academy</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>it.wordpress.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.innovationprocurement.academy</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://www.innovationprocurement.academy/wp-admin/comment.php</name>
        <report_id>eb43c95a-ed97-4847-aea0-ad4018dbbc65</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e9f4917373b52392e7a1e44513e42f711571c709a5343e60e223759a41f1b561</id>
    <title>Analysis Report for e9f4917373b52392e7a1e44513e42f711571c709a5343e60e223759a41f1b561</title>
    <updated>2026-08-20T23:25:47Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878d0b49c2438a47b72f1a</_id>
        <file_type>text/html</file_type>
        <flow_id>6a878cfbf21817d7f9087bef</flow_id>
        <hash>e9f4917373b52392e7a1e44513e42f711571c709a5343e60e223759a41f1b561</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/comment.php</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://it.wordpress.org/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/comment.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/js/password-strength-meter.min.js?ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/js/user-profile.min.js?ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/load-scripts.php?c=0&amp;load%5Bchunk_0%5D=clipboard</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/load-styles.php?c=0&amp;dir=ltr&amp;load%5Bchunk_0%5D=dashicons,buttons,forms,l10n,wp-base-styles,wp-tooltip,login&amp;ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/dist/a11y.min.js?ver=31c6cec5a4ff7aff483d</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/dist/dom-ready.min.js?ver=3fe927cab37bf38d6a23</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/dist/i18n.min.js?ver=1dfe7db3940c23ea9216</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/underscore.min.js?ver=1.13.8</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/wp-tooltip.js?ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/wp-util.min.js?ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/zxcvbn.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-login.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-login.php?action=lostpassword</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>innovationprocurement.academy</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>it.wordpress.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.innovationprocurement.academy</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://www.innovationprocurement.academy/wp-admin/comment.php</name>
        <report_id>14cc86cf-4700-4973-a081-144a9beb4d07</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0f205a4e5167ce80bad93eac802731098f93c9912490960b873a820b196a35ab</id>
    <title>Analysis Report for 0f205a4e5167ce80bad93eac802731098f93c9912490960b873a820b196a35ab</title>
    <updated>2026-08-20T23:25:35Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878cfe49c2438a47b72f17</_id>
        <file_type>text/html</file_type>
        <flow_id>6a878ceebefbfb13af7f204e</flow_id>
        <hash>0f205a4e5167ce80bad93eac802731098f93c9912490960b873a820b196a35ab</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/edit-comments.php</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://it.wordpress.org/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/edit-comments.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/js/password-strength-meter.min.js?ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/js/user-profile.min.js?ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/load-scripts.php?c=0&amp;load%5Bchunk_0%5D=clipboard</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/load-styles.php?c=0&amp;dir=ltr&amp;load%5Bchunk_0%5D=dashicons,buttons,forms,l10n,wp-base-styles,wp-tooltip,login&amp;ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/dist/a11y.min.js?ver=31c6cec5a4ff7aff483d</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/dist/dom-ready.min.js?ver=3fe927cab37bf38d6a23</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/dist/i18n.min.js?ver=1dfe7db3940c23ea9216</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/underscore.min.js?ver=1.13.8</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/wp-tooltip.js?ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/wp-util.min.js?ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/zxcvbn.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-login.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-login.php?action=lostpassword</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>innovationprocurement.academy</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>it.wordpress.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.innovationprocurement.academy</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://www.innovationprocurement.academy/wp-admin/edit-comments.php</name>
        <report_id>1dbe06e8-23a8-4285-8494-0cb3a9c518c8</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0f205a4e5167ce80bad93eac802731098f93c9912490960b873a820b196a35ab</id>
    <title>Analysis Report for 0f205a4e5167ce80bad93eac802731098f93c9912490960b873a820b196a35ab</title>
    <updated>2026-08-20T23:25:30Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878cf9f2677ae4d366dba4</_id>
        <file_type>text/html</file_type>
        <flow_id>6a878ce9f21817d7f9087bcc</flow_id>
        <hash>0f205a4e5167ce80bad93eac802731098f93c9912490960b873a820b196a35ab</hash>
        <iocs>
          <urls>
            <value>
              <url>https://it.wordpress.org/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/edit-comments.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/js/password-strength-meter.min.js?ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/js/user-profile.min.js?ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/load-scripts.php?c=0&amp;load%5Bchunk_0%5D=clipboard</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/load-styles.php?c=0&amp;dir=ltr&amp;load%5Bchunk_0%5D=dashicons,buttons,forms,l10n,wp-base-styles,wp-tooltip,login&amp;ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/dist/a11y.min.js?ver=31c6cec5a4ff7aff483d</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/dist/dom-ready.min.js?ver=3fe927cab37bf38d6a23</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/dist/i18n.min.js?ver=1dfe7db3940c23ea9216</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/underscore.min.js?ver=1.13.8</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/wp-tooltip.js?ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/wp-util.min.js?ver=7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-includes/js/zxcvbn.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-login.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-login.php?action=lostpassword</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.innovationprocurement.academy/wp-admin/edit-comments.php</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>innovationprocurement.academy</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>it.wordpress.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.innovationprocurement.academy</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
        </iocs>
        <name>hxxps://www.innovationprocurement.academy/wp-admin/edit-comments.php</name>
        <report_id>c00107a1-3250-4d57-a6d1-8b7f2564425f</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>7ef021039fcc397f9cf378e995c448c4312f1f0ea13d05020d6f55a7749d12af</id>
    <title>Analysis Report for 7ef021039fcc397f9cf378e995c448c4312f1f0ea13d05020d6f55a7749d12af</title>
    <updated>2026-08-20T23:22:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878c4df2677ae4d366db85</_id>
        <file_type>application/x-ms-installer</file_type>
        <flow_id>6a878c2bbefbfb13af7f1e00</flow_id>
        <hash>7ef021039fcc397f9cf378e995c448c4312f1f0ea13d05020d6f55a7749d12af</hash>
        <iocs>
          <urls>
            <value>
              <url>http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crt0_</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedRootG4.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.digicert.com/CPS0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://go.microsoft.com/fwlink/p/?LinkId=2124703</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://wixtoolset.org/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cacerts.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl3.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl4.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>go.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>wixtoolset.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>72.246.29.230</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.11.40.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.67.139.212</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>45.60.121.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>43b4569c85c87cbb9696284f446ab61571af48d174067e627e1151a0701828cf</SHA-256>
              <SHA-1>fc630bb89541b367f25314b67b9f88ce39c0e810</SHA-1>
              <MD5>22c2b5777707a824ec54b6660166e32f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df</SHA-256>
              <SHA-1>4260284ce14278c397aaf6f389c1609b0ab0ce51</SHA-1>
              <MD5>1e4a89b11eae0fcf8bb5fdd5ec3b6f61</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>5fa39172fbc62e01b03c618631e8e2015e95087158fb329ae49928695a8c08c8</SHA-256>
              <SHA-1>b9e5cca29d2ea4592d3fcc695e3eed96d50a3b17</SHA-1>
              <MD5>507f6de07375ff876fd498402acb24d2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc</SHA-256>
              <SHA-1>d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57</SHA-1>
              <MD5>cfbb8568bd3711a97e6124c56fcfa8d9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>82ccc23204941f4bce68068e74522ffd0f122a2170ae6bb431c4b4af9f1c31d6</SHA-256>
              <SHA-1>e669074d33c9232a0fd02c244e5f76784b51202e</SHA-1>
              <MD5>3e85e07417bc500f6665cc55c6b00958</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>8e659b326afa58276d95ae143af18786f3c47f9e45fa9f4bc9afdfcd10f99aef</SHA-256>
              <SHA-1>b3006ef8c220ffa04308b4d58a8415c2b41e2d08</SHA-1>
              <MD5>274a0ba53a9c1bf4af8843978c680dd5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
            <value>
              <SHA-256>a5c224e720d401aa9361f1cf306781c4374d26455fa0a63901b15f0f345690cd</SHA-256>
              <SHA-1>e70f06faee86482251620c558b34e5c43eeb0233</SHA-1>
              <MD5>1c145f9c42c06a99cfa0a21360eeff89</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>b1cb832f790c153aa0e9a66f76e75460263cf1d41971d2dbcc9a4d87ec18b7d8</SHA-256>
              <SHA-1>2a4224d31c916a5cff4f2636a3cb47fdd84a5cc9</SHA-1>
              <MD5>01e4c8c046a47771f13cd120b53303e7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>b7c784604bd21f365ddbd8eef4a9f928340a92982cd54472f85ca0915247aa79</SHA-256>
              <SHA-1>1ecce411485e686173c1331b4a9e8bcd3ec4c448</SHA-1>
              <MD5>6fe0e743a61a436b9b03adcdd565fdb5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>b86b1fd03c5922ae01312cf5de26f60573b52a6e905db3e03e2b00bafe2da8d8</SHA-256>
              <SHA-1>9d6cd0bf7e27204515ad322b151ab03729f14e23</SHA-1>
              <MD5>44cc4a2486731238a5499bcfc85a748a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>cdf9000eb0608a423dedac506f84b6aee68a20ebcdd73495b836b1f9833b1fb3</SHA-256>
              <SHA-1>549de0baed4c4517a84b85050a42cbfdb7b9a459</SHA-1>
              <MD5>e7e15fa2dc24fb95c86aec0a028ae601</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>daf6e6bd4739ef4be2b36cba1505ba82a573fcb02d3fc1d7fc8a5e4e8590eed8</SHA-256>
              <SHA-1>d8145a6f3b5fa9b3adf6850316f5c6fc0ff53f32</SHA-1>
              <MD5>233d182e8bcdc8f3403aaa055f89433a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>fba51ea8283b8e5b2c441635f64a3bc705ca43c42f59721577c3d9198b721cd9</SHA-256>
              <SHA-1>8a4e2875873140dd1fd12f96d31eb9ca3e5f6a86</SHA-1>
              <MD5>539458ae130df746a5bcf9b9df5fca23</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>2B412EEC-4109-4D4E-A042-2CD347432CD3</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4DC38C4A-AC06-447C-AD45-C43F1E1F3B78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>9575EDB8-967E-5543-9606-9225FC0F6B59</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>95D0647A-CDC0-5EDC-A51A-97B9EDA8CD75</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>974E9012-C44A-5773-B1CF-4A87BAF177A1</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>F3017226-FE2A-4295-8BDF-00C3A9A7E4C5</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>F74240AB-6CF8-505D-ACE0-7C0BBC837E9A</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\Policies\Microsoft\Windows\Installer</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>Retrac_3.0.9_x64_en-US.msi</name>
        <report_id>163b1955-d979-40d1-9933-784c50c78d0a</report_id>
        <tags>
          <value>msi</value>
          <value>keylogger</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>installer</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>expired-cert</value>
          <value>signed</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>b0449d44e802c09f084afe81a9d927de19e83b52d922a171d12e61e7d8167231</id>
    <title>Analysis Report for b0449d44e802c09f084afe81a9d927de19e83b52d922a171d12e61e7d8167231</title>
    <updated>2026-08-20T23:21:41Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878c36f2677ae4d366db7f</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a878c04f21817d7f90879eb</flow_id>
        <hash>b0449d44e802c09f084afe81a9d927de19e83b52d922a171d12e61e7d8167231</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cdn.discordapp.com/attachments/1516626423094313031/1540136735869116487/all_in_one_free_cheats.exe?ex=6a88db9c&amp;is=6a878a1c&amp;hm=c0f8f12b58486bdee041809726043169aa71d1705ccb59a8d57bff4ef996516f&amp;</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
        </iocs>
        <name>hxxps://cdn.discordapp.com/attachments/1516626423094313031/1540136735869116487/all_in_one_free_cheats.exe?ex=6a88db9c&amp;is=6a878a1c&amp;hm=c0f8f12b58486bdee041809726043169aa71d1705ccb59a8d57bff4ef996516f&amp;</name>
        <report_id>1598fd63-499c-4a83-939c-9be4a11899ac</report_id>
        <tags>
          <value>peexe</value>
          <value>similar-threat</value>
          <value>crypto</value>
          <value>reconnaissance</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0e247b778712e3b98f3200573610db90173c32be8b82323326ad8c661c1442e4</id>
    <title>Analysis Report for 0e247b778712e3b98f3200573610db90173c32be8b82323326ad8c661c1442e4</title>
    <updated>2026-08-20T23:21:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878c1bf2677ae4d366db7a</_id>
        <file_type>application/x-msdownload; format=pe64</file_type>
        <flow_id>6a878bef009ae7a1a8d2f9d2</flow_id>
        <hash>0e247b778712e3b98f3200573610db90173c32be8b82323326ad8c661c1442e4</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>2c734a8e48c369041714740cecbce3eaeb826aedd7f818b757e088bced76ef04</SHA-256>
              <SHA-1>80b1a64cda120c786c9a6c5cd9187f8878d679c4</SHA-1>
              <MD5>7af05795bed77905e6137542aeb289df</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>4a0c92bdd4297f7eb7aefcbed01200a72de2ac5269ea3eb22b1cebdf9e4298fd</SHA-256>
              <SHA-1>16431886bcea55668b1e7f7c7cef7024d1d5c45d</SHA-1>
              <MD5>9c94b38dd473ccbba273e1c364320fa0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>9ecc939db4c18e00cef16a302850c90a60af433186e763158f76587f48039a74</SHA-256>
              <SHA-1>2ced65d5cb21aec4fd237d44121fc78b704bbbed</SHA-1>
              <MD5>347476678b22295e4d15d1261c2af90e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c051db3aff39c9662af2dc685426599f90dd38f556b4a34ba3f590a8fe4a0dc2</SHA-256>
              <SHA-1>f4db5b02363d350d1088e6ea5a509fefa5783820</SHA-1>
              <MD5>669eeb8de6f45ad8f8dfcf477e42e328</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c056d0229555da971517df73dd98fe8f9bedc7e782122c9594ee0da314bc002d</SHA-256>
              <SHA-1>b41d7972d48879e9ac233b3e4d4788165cc4f613</SHA-1>
              <MD5>3f53a1aed1ae6ff700879068d73258c9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>RealUI_v3.98.465.exe</name>
        <report_id>22e53d3c-41b0-417d-9121-88d10ff39131</report_id>
        <tags>
          <value>peexe</value>
          <value>adaptive-context</value>
          <value>packed</value>
          <value>overlay</value>
          <value>mingw</value>
          <value>anti-debug</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>44e7af5e5bd2b34bd8dfe0baddc347ca247091837fbd8ee6a2d4a0a79d339389</id>
    <title>Analysis Report for 44e7af5e5bd2b34bd8dfe0baddc347ca247091837fbd8ee6a2d4a0a79d339389</title>
    <updated>2026-08-20T23:21:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878c08f2677ae4d366db75</_id>
        <file_type>application/x-msdownload; format=pe64</file_type>
        <flow_id>6a878beeeeadd95beca18562</flow_id>
        <hash>44e7af5e5bd2b34bd8dfe0baddc347ca247091837fbd8ee6a2d4a0a79d339389</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>96a225d8a43aa706dfa755a40763e8089ebbb0b33b70ca91fd0941030de5189f</SHA-256>
              <SHA-1>52b3804fccadd0efef4e07a55096f356b00a5dea</SHA-1>
              <MD5>a7f0fd620b7417f1669b77e387663e2f</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/x-msdownload; format=pe64</file_type>
            </value>
          </files>
        </iocs>
        <name>44e7af5e5bd2b34bd8dfe0baddc347ca247091837fbd8ee6a2d4a0a79d339389.exe</name>
        <report_id>4827cfff-ad74-4cca-8267-caf9e30635af</report_id>
        <tags>
          <value>peexe</value>
          <value>packed</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0e247b778712e3b98f3200573610db90173c32be8b82323326ad8c661c1442e4</id>
    <title>Analysis Report for 0e247b778712e3b98f3200573610db90173c32be8b82323326ad8c661c1442e4</title>
    <updated>2026-08-20T23:20:16Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878bdaf2677ae4d366db6b</_id>
        <file_type>application/x-msdownload; format=pe64</file_type>
        <flow_id>6a878ba9befbfb13af7f1c66</flow_id>
        <hash>0e247b778712e3b98f3200573610db90173c32be8b82323326ad8c661c1442e4</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>2c734a8e48c369041714740cecbce3eaeb826aedd7f818b757e088bced76ef04</SHA-256>
              <SHA-1>80b1a64cda120c786c9a6c5cd9187f8878d679c4</SHA-1>
              <MD5>7af05795bed77905e6137542aeb289df</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>4a0c92bdd4297f7eb7aefcbed01200a72de2ac5269ea3eb22b1cebdf9e4298fd</SHA-256>
              <SHA-1>16431886bcea55668b1e7f7c7cef7024d1d5c45d</SHA-1>
              <MD5>9c94b38dd473ccbba273e1c364320fa0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>9ecc939db4c18e00cef16a302850c90a60af433186e763158f76587f48039a74</SHA-256>
              <SHA-1>2ced65d5cb21aec4fd237d44121fc78b704bbbed</SHA-1>
              <MD5>347476678b22295e4d15d1261c2af90e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c051db3aff39c9662af2dc685426599f90dd38f556b4a34ba3f590a8fe4a0dc2</SHA-256>
              <SHA-1>f4db5b02363d350d1088e6ea5a509fefa5783820</SHA-1>
              <MD5>669eeb8de6f45ad8f8dfcf477e42e328</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c056d0229555da971517df73dd98fe8f9bedc7e782122c9594ee0da314bc002d</SHA-256>
              <SHA-1>b41d7972d48879e9ac233b3e4d4788165cc4f613</SHA-1>
              <MD5>3f53a1aed1ae6ff700879068d73258c9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>RealUI_v3.98.465.exe</name>
        <report_id>bde0b5b1-10ae-45de-b803-69af660e4ae7</report_id>
        <tags>
          <value>peexe</value>
          <value>adaptive-context</value>
          <value>packed</value>
          <value>overlay</value>
          <value>mingw</value>
          <value>anti-debug</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>cfb97b07d61038a70dfcb8e6fb456ac8192d600418b567a0b78f4301b3dc2ea9</id>
    <title>Analysis Report for cfb97b07d61038a70dfcb8e6fb456ac8192d600418b567a0b78f4301b3dc2ea9</title>
    <updated>2026-08-20T23:18:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878b86f2677ae4d366db56</_id>
        <file_type>application/x-ms-installer</file_type>
        <flow_id>6a878b35befbfb13af7f1b0f</flow_id>
        <hash>cfb97b07d61038a70dfcb8e6fb456ac8192d600418b567a0b78f4301b3dc2ea9</hash>
        <iocs>
          <urls>
            <value>
              <url>http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedRootG4.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.digicert.com/CPS0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://aka.ms/dotnet-core-applaunch?</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://aka.ms/dotnet/app-launch-failed</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://dynamic-data.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://dynamic-data.org/</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://github.com/benruehl/adonis-ui</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/dotnet/core</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://go.microsoft.com/fwlink/?linkid=798306</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://reactiveui.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://reactiveui.net/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://wixtoolset.org/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>aka.ms</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>cacerts.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl3.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl4.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>dynamic-data.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>github.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>go.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>reactiveui.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>wixtoolset.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>23.11.40.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.121.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.67.139.212</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>188.114.96.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.21.80.150</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>2.23.246.9</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>2.0.2.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>5.0.2.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>45.60.131.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>72.246.29.230</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>10996d6b990ec678b7e5ad043db091960e1cde12b57742cab6f3cdb7eb49cd98</SHA-256>
              <SHA-1>8ad088832757321532a68f3f9b845313fa4803a6</SHA-1>
              <MD5>50f8fdaed8bbfe0d09643a801e7946c3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>1cc6f73e334c6eba87bd08ea50716cef122e8fa1d525d082639c9eb7afb91e22</SHA-256>
              <SHA-1>307275e24bbf926f795000e267573c1e8d1c2f4f</SHA-1>
              <MD5>4c11b41f10de5d3f00edc55cf78b4168</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>410d1103f60e43c494ed44a725b5876097de2b7eb18b7547223979f20114d94e</SHA-256>
              <SHA-1>0d56e99081c5585ad678a43ba92355723b0553c9</SHA-1>
              <MD5>cab2a935d51a558320059188704c83b4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df</SHA-256>
              <SHA-1>4260284ce14278c397aaf6f389c1609b0ab0ce51</SHA-1>
              <MD5>1e4a89b11eae0fcf8bb5fdd5ec3b6f61</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>4bfb69cba5505ff07e4d5297998a2532ce7481a5259acd0b5b413dcb8fcabfd8</SHA-256>
              <SHA-1>c833354b1298551942e192ef57258fa3777a3259</SHA-1>
              <MD5>f3676188ce156e8f0350f24f8b986735</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>53579b0970fa3a670f27b6cb92a015f26a8af1c7f9ddab7cf7102b918a91e654</SHA-256>
              <SHA-1>d107c59d33f2fdebcba85b9de6dbf0883f1f8b1b</SHA-1>
              <MD5>f63d3cc64cb3b05ab66ca685a921bc68</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a</SHA-256>
              <SHA-1>cac699787884fb993ced8d7dc47b7c522c7bc734</SHA-1>
              <MD5>b7db84991f23a680df8e95af8946f9c9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>594d36fbbeb0d72af1fe8a7b33ab0af705f4ab32307fe1d05835a68905bda509</SHA-256>
              <SHA-1>21faa68bf59461583e4e46d7480f410c83f3e39f</SHA-1>
              <MD5>32250d58e4e5ef600ea516e8438e39c7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>6aab425f6bd635903ff5611d0d59525cbccf0e2be2e95eeb6cbb8f017879ae32</SHA-256>
              <SHA-1>c4add587542e677db7a92d60b9c32ed2ee14913f</SHA-1>
              <MD5>8d4d6a43eec62ddf84240d30aabf9607</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>74f969ca05e7f34fc5e8c80f0e9534f3d574730d585431c0ccb6522d818d5dbc</SHA-256>
              <SHA-1>201a74f97a9bdb84bbe7aa4d3f597075153594a2</SHA-1>
              <MD5>4e54e044f6f1e33210df7b61342d6dfb</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>9838abd739c63e15d32242c049b40c1655d552d3e7b9a26705d1486a56991b04</SHA-256>
              <SHA-1>2979cabf0b652fd858ed02f92da9ddb5bc2b31d3</SHA-1>
              <MD5>6044ae95a1549c46e2f1f4ecb0ea8a70</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>9b32f51bfceeb31936619bc94ae8eb837fdb579872b71b1d2425a1931c627c04</SHA-256>
              <SHA-1>0c077afbc0adc2fb52224c6032d347716fb4f699</SHA-1>
              <MD5>e23f66f9cfdc9a1aca08f4885c58f1ec</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>9d6745913a51d4c6749a4119f87da410cb226c45a72d6dbc3231efe5b928f491</SHA-256>
              <SHA-1>c0f986dbb344aab2efe92bffbc8e683f11558f80</SHA-1>
              <MD5>543072c649a87e1880784b7f0effaeeb</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>a30695547fc639666a63caa80ee5cd558b60232c566400ee60c430e8417e27ac</SHA-256>
              <SHA-1>c8564259e874a70e4d9877602eb15d01db111e2e</SHA-1>
              <MD5>9b6dad346e0ec448a9c5286911395a99</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>a6ea868a20866be25a710d944e2009d813a9da7d88207fb565f1bfd2d45d2b87</SHA-256>
              <SHA-1>3b714e75bf02d358246dbb41b11f3264eb38b112</SHA-1>
              <MD5>41790e171395a75040378e1b15c39deb</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/x-msdos-batch</file_type>
            </value>
            <value>
              <SHA-256>a8e9ae9022b715422b08032183de5d2f6f2e2b29b4df96b48331683fd3996b97</SHA-256>
              <SHA-1>bae401b2f979570f5fa33e9b3cbfd3f59aa53338</SHA-1>
              <MD5>fd6dc29ecdf3646196941e6050a16905</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>c7e5b6e5d755aa7332d64598e852e92a71123a12da18663c66f273f4537cb98f</SHA-256>
              <SHA-1>7fc1302cb79077ac71f7440ad8aca9be2bf12d1f</SHA-1>
              <MD5>cdc24e7d311b086e0e54375e32ddb997</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
            <value>
              <SHA-256>cb219723e277bcf7abd6f699c9ee73fd0d8e700f6f37d11363f870befd8de390</SHA-256>
              <SHA-1>898a77654d2bc81e1319d0d8e0cd23688f397140</SHA-1>
              <MD5>5dbba6c27f4596309316c3a2b4c32a66</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>dca8207d0bf765ff36cdbd4b2ac56e34fbb760124f96b38fa52b37ae62339227</SHA-256>
              <SHA-1>a650191fdaafb33e381d9bca2eddd0a6b009a988</SHA-1>
              <MD5>c5e8e4ed9f85bda69e632491f079e7c2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>eeb9e93edca1d2a9962c23b2edf5a28327988bfb7431f909c8ac481136915955</SHA-256>
              <SHA-1>bdc1917c7afe8cce7a7eefe07ccbe105d8262188</SHA-1>
              <MD5>5e1fb95ddd3b09bd25e1701ae206ffc6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>f2a82ccf044d3a916e02c6614bbf7d63771f932ec84d3370dae3e87fd72ea425</SHA-256>
              <SHA-1>8833a1c0b586a9cc55e0e49bb36e9e2a1c819adc</SHA-1>
              <MD5>18e969ffe882860e1b124eb4e3acd6ff</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>036C3C1A-FA77-46CD-97F9-26653E110D8F</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>03DF99E8-879E-5B78-9FC5-70B7703B7F24</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>1AC9D063-74DA-4D56-BA4A-C7F4216CFAF3</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>2267CCD8-EA6D-5F5B-93FB-C239A7010917</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>234A19A3-939E-54FD-B366-C0C99CFE67EB</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>251FF4FA-4049-5505-B7FA-B0D6B892A05D</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>2D02570E-B908-56C0-9B97-BB87295FBA13</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>30BDEDF1-C0E4-573F-AEE3-5A67ABF049C9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>34581875-DDA5-598E-83EA-627001E35CB8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>3868E885-EEEE-4551-90BB-17244F8A9669</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>3D4ACB3A-BFB3-5677-8C32-0928E4333079</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4BE5096B-F0A8-52B6-A9F3-6598B59303BC</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4CC14A36-D9D3-51FD-AF96-51DD7513737E</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4E1B41B6-FB70-5F72-8A1A-520D2792BCD3</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4EFB2330-20FC-57D2-87B6-E4D190AAC2D5</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>5759CD95-EF47-5BF7-8557-C02AF8D3FA22</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>6D2F617E-9928-57DB-9FA2-37CE6383CE57</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>72DBB959-922B-5D7F-A695-E2C239FC6B47</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>7BB646DE-DF31-569B-B67E-444AF62941C9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>876B0F66-73A9-589A-AECA-2AB6480B2E52</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8C099A3C-4225-5D0E-9D89-E37CB626AE56</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>952C962B-5234-5EFC-88B4-53BE8A8D89AE</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>97D34D97-9807-5D34-A310-66F6610CED0D</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>9B1F604F-1FA3-43BF-9EB0-E71565ADE974</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>9D7B296F-73EF-542F-B0E5-7542D800FBD0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>AA1B51F4-CE28-5FEC-A6DA-7DFE2CD87CA2</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>B118DC64-152D-5B63-9067-C7EB2C7C822B</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>B9B4A11F-5E8F-5D69-9B86-F64880F2BD6A</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>BA5AB818-4FFA-5565-8E03-3441C11285EE</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>C2F5B43C-1851-5BF5-9FAF-FBEB18C32C9A</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>C601F684-D128-41B9-B3E6-153147942F67</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>CE5BE3D5-C6A5-5015-8BD5-864693669EBF</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>CFCBDF3F-2810-53C7-B8D4-070641A490B7</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>D0D49E61-5C7B-5C05-849F-079E0B15068B</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>DC5233D1-F0E1-5669-A433-104FE4578261</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>E14AE9A8-E1ED-5156-8998-D5B6BC964CDD</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>E8323D3D-1AB6-55B3-83B7-818DE8CB7E18</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>F18932FF-4F48-40C9-A60E-C2BE7881797D</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>F69A1270-EC28-5DAC-B704-87A5D02BE985</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>FF7C903C-9DF5-561F-8715-8D25B7F7B1ED</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>d38cc827-e34f-4453-9df4-1e796e9f1d07</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\Classes\Directory\shell\ImageSort</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Classes\Drive\shell\ImageSort</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Classes\Folder\shell\ImageSort</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Policies\Microsoft\Windows\Installer</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>ImageSort.x64.msi</name>
        <report_id>11495040-b5ba-4b85-b38e-9eafc127a180</report_id>
        <tags>
          <value>msi</value>
          <value>reconnaissance</value>
          <value>dotnet</value>
          <value>installer</value>
          <value>lolbin</value>
          <value>wix</value>
          <value>expired-cert</value>
          <value>anti-debug</value>
          <value>overlay</value>
          <value>masquerade</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>1c1c60513a8409c24ad8c8938f113ba38cb7f42b7f06f5f37ef4565e99127aa1</id>
    <title>Analysis Report for 1c1c60513a8409c24ad8c8938f113ba38cb7f42b7f06f5f37ef4565e99127aa1</title>
    <updated>2026-08-20T23:18:06Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878b9af2677ae4d366db5b</_id>
        <file_type>text/html</file_type>
        <flow_id>6a878b2beeadd95beca184e0</flow_id>
        <hash>1c1c60513a8409c24ad8c8938f113ba38cb7f42b7f06f5f37ef4565e99127aa1</hash>
        <iocs>
          <urls>
            <value>
              <url>https://44.238.122.172/is?cb=1787267950235</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://a.usbrowserspeed.com/cs?pid=c59fd74cbd71a58d3d354f836099a3cf5a29e8461d70dad1ea560c3559765bfc&amp;puid=usergems-6qypZ1fMCurJpfmW-931d569b119a4cc786c0e978c2a2b8ba-931d569b_119a_4cc7_86c0_e978c2a2b8ba-%2F</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://a.usbrowserspeed.com/ncs?pid=c59fd74cbd71a58d3d354f836099a3cf5a29e8461d70dad1ea560c3559765bfc&amp;puid=usergems-6qypZ1fMCurJpfmW-931d569b119a4cc786c0e978c2a2b8ba-931d569b_119a_4cc7_86c0_e978c2a2b8ba-%252F</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ad.doubleclick.net/ccm/s/collect?auid=1621158021.1787267950&amp;gtm=45He68j0v811381218za200zd811381218xea&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://analytics.sayprimer.com/primerAnalytics.js?clientId=a43cb8a1-4ef1-4203-8358-6bc13cacfba9</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://api.hubspot.com/livechat-public/v1/message/public?portalId=22500591&amp;conversations-embed=static-1.28067&amp;mobile=false&amp;messagesUtk=6c935ece1a434811a0ab3b63141a0b9b&amp;traceId=6c935ece1a434811a0ab3b63141a0b9b</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://api.unifyintent.com/analytics/v1/page</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://api.usergems.com/v1/flow/success</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://api.usergems.com/v1/identify/usergems</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://api.usergems.com/v1/visit</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://app.hubspot.com/conversations-visitor/22500591/threads/utk/6c935ece1a434811a0ab3b63141a0b9b</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://app.hubspot.com/conversations-visitor/22500591/threads/utk/6c935ece1a434811a0ab3b63141a0b9b?uuid=d1fff8639d8e4b76974347243980bfcf&amp;mobile=false&amp;mobileSafari=false&amp;hideWelcomeMessage=false&amp;hstc=&amp;domain=testimonialhero.com&amp;inApp53=false&amp;messagesUtk=6c935ece1a434811a0ab3b63141a0b9b&amp;url=https%3A%2F%2Fwww.testimonialhero.com%2F%3Futm_content%3Dsignature_website_plain%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;inline=false&amp;isFullscreen=false&amp;globalCookieOptOut=&amp;isFirstVisitorSession=true&amp;isAttachmentDisabled=false&amp;isInitialInputFocusDisabled=false&amp;enableWidgetCookieBanner=false&amp;isInCMS=false&amp;hideScrollToButton=true&amp;isIOSMobile=false</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://app.testimonialhero.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.com/bat.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.com/p/action/56339939.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.net/action/0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.net/action/0?ti=56339939&amp;tm=gtm002&amp;Ver=2&amp;mid=6309d900-be79-4310-8a58-f24e1627470b&amp;bo=2&amp;pi=918639831&amp;lg=en-US&amp;sw=800&amp;sh=600&amp;sc=24&amp;nwd=1&amp;tl=Testimonial%20Hero%20%7C%20Video%20Testimonials%20that%20Close%20Deals%20Faster&amp;p=https%3A%2F%2Fwww.testimonialhero.com%2F%3Futm_content%3Dsignature_website_plain%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;r=&amp;lt=527&amp;evt=pageLoad&amp;sv=2&amp;asc=D&amp;cdb=AQAQ&amp;rn=848889</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.net/actionp/0?ti=56339939&amp;tm=gtm002&amp;Ver=2&amp;mid=6309d900-be79-4310-8a58-f24e1627470b&amp;bo=1&amp;evt=consent&amp;src=default&amp;cdb=AQAQ&amp;asc=D</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2F2ngbw0m2tt&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2F2ngbw0m2tt&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F3d66bf6bb4a3796dc8173ef2bd022608.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2F2vecxbq12q&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2F2vecxbq12q&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F2c944dfb5dd2e79206e3a5edb70e2859.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2F8de20w5wxf&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2F8de20w5wxf&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2Ff143762908ee9e5d98628850d86850c7.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fjoq4qyrvdu&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fjoq4qyrvdu&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F971edd048e7f2e1dff70afb8addf4c86.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fk84r5jzeh3&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ffast.wistia.com%2Fembed%2Fmedias%2Fk84r5jzeh3.json&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2Fac76f109e0b8943ace4875a8762812a8.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fkje20oek6f&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fkje20oek6f&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2Fc2aae30c8ddac123c9107d47ffcb37f6.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fmdc2lf40un&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fmdc2lf40un&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F30490efd745eabc2f3d14e80fd7b3414.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fmqhj49cpt0&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fmqhj49cpt0&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F974e960edca6a78a462a61d1c9251173.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fof5yu1k6g6&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fof5yu1k6g6&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F7fc0cf543048ede4fffc9f3be7e07c5a.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fp1wqs7r5x0&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ffast.wistia.com%2Fembed%2Fmedias%2Fp1wqs7r5x0.json&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2Fa09f4349f6372b1a5501f33d64ac4765.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3.4.2/dist/fp.umd.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.jsdelivr.net/npm/@finsweet/attributes-animation@1/animation.esm.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.jsdelivr.net/npm/@finsweet/attributes-cmscore@1/cmscore.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.jsdelivr.net/npm/@finsweet/attributes-cmsfilter@1/cmsfilter.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.jsdelivr.net/npm/@finsweet/attributes-toc@1/toc.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.jsdelivr.net/npm/js-cookie@2/src/js.cookie.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282%2F68226cc36049c3541c0f8d0b_written%20case%20study-poster-00001.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282%2F68226cc36049c3541c0f8d0b_written%20case%20study-transcode.mp4</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282%2F68226cfe568eb6264c3461e9_one-page%20case%20studys-transcode.mp4</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282%2F68226d0e07a621f12a169c1c_sales%20slides-transcode.mp4</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282%2F68226d15ea92cf67791a024c_quote%20cards-transcode.mp4</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/61c1ec16984f4426ea3a12b1_fa-brands-400.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/61c4ced2dccfe63cde389b09_g2-logo-1.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/626b9db898a54510a9875970_Testimonial-Hero-Favicon-32.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/673392f4d429563c952f97a2_icons8-login-60%20(1).avif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/6736792b2f3d0b6b2f81a72a_P22%20Mackinac%20Pro%20Book%20Italic.otf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/67367c10937bba27c4b93316_texture-1.avif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/67367d98e4c792a7e65689e3_gradient%20line%201.avif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/67543cf8bb85ddbc7745e635_greenchecklist.avif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/68d46af9370eec9bcef8db11_TestimonialHero%20w_%20Sub-mark%20-%20Light.avif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/6924a51c3a5f8ea722dacb3d_693a464da820885a8ca8564f9f000157_Image%20129.avif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/6924a51c479a585c943834a2_b689d698c6ae6d37037d140ac34770b7_Image%20127.avif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/6936b4db20f0605c697dc1f7_user-circle.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/6936b4db307bc3c16cf61cad_chart-line-down.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/6936b4db32834a1592910108_lock%20(1).svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/6936b4dbb045e483326100b9_alarm.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/695f0319e5a889031de7d3e4_4e5b6e5609c090d66703630588f7655d_Image%20187.avif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/css/th-v2-c2f4c3.webflow.shared.908f50965.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/js/webflow.7b7ad42a.d9bb3289333a3c08.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/js/webflow.schunk.121b0d7ff03e0f4a.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/js/webflow.schunk.36b8fb49256177c8.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/js/webflow.schunk.50508ae72ac99c7f.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/js/webflow.schunk.9dfb96661114d3db.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/js/webflow.schunk.f919141e3448519b.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61e9bba1ce5e643f48e0e0b8/67c0e00b500ce2b035db5313_67c0ddd4daa8d7896c3803f0_Amplitude-p-500.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61e9bba1ce5e643f48e0e0b8/67c1cc8c5f090df9ac0210a2_hubspot-p-500.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61e9bba1ce5e643f48e0e0b8/67c1cc9f3febbfd0edcc5361_intercom.avif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61e9bba1ce5e643f48e0e0b8/67c1ccc8bbf8fccb8753b36d_alteryx-p-500.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61e9bba1ce5e643f48e0e0b8/67c1cd2a979b04b47ddc4453_axonius.avif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61e9bba1ce5e643f48e0e0b8/67c1cd4a843db8b6c709c755_ninjaone-p-500.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61e9bba1ce5e643f48e0e0b8/67c1cd7ebdc202b579edd568_gong.avif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61e9bba1ce5e643f48e0e0b8/67c1cda6c0ee7c6c02638570_redpanda-p-500.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61e9bba1ce5e643f48e0e0b8/67c1cdceba817184bb0ea9d5_rocketsoftware-p-500.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61e9bba1ce5e643f48e0e0b8/67c22661ccc1c984a79a8772_67c1cd04517695601e81965d_qlik%20copy-p-500.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61e9bba1ce5e643f48e0e0b8/680837febece0e8b07f11dfa_2grammarly.avif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61e9bba1ce5e643f48e0e0b8/6a79df7fcba22509792dbb10_Docusign%20(new)-p-500.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://connect.facebook.net/en_US/fbevents.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://connect.facebook.net/signals/config/552233715552562</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://connect.facebook.net/signals/config/552233715552562?v=2.9.383&amp;r=stable&amp;domain=www.testimonialhero.com&amp;hme=0bf241557322ccbde3f88f73199a2e0cb29b567dd5a781d75c4457dac12f5177&amp;ex_m=113%2C218%2C164%2C25%2C78%2C79%2C156%2C74%2C73%2C11%2C174%2C98%2C19%2C148%2C136%2C43%2C81%2C86%2C144%2C169%2C176%2C29%2C17%2C30%2C31%2C32%2C34%2C52%2C157%2C83%2C121%2C21%2C23%2C48%2C44%2C46%2C45%2C91%2C100%2C104%2C119%2C155%2C158%2C50%2C120%2C27%2C24%2C128%2C75%2C40%2C160%2C159%2C161%2C152%2C150%2C28%2C39%2C63%2C118%2C171%2C76%2C20%2C123%2C89%2C72%2C22%2C93%2C94%2C125%2C92%2C146%2C145%2C149%2C105%2C170%2C173%2C38%2C53%2C122%2C51%2C8%2C4%2C5%2C7%2C6%2C3%2C99%2C110%2C177%2C185%2C232%2C80%2C245%2C244%2C243%2C14%2C26%2C37%2C59%2C112%2C65%2C10%2C69%2C106%2C107%2C108%2C114%2C139%2C35%2C33%2C141%2C142%2C143%2C138%2C137%2C165%2C82%2C168%2C166%2C167%2C54%2C64%2C132%2C18%2C172%2C49%2C291%2C292%2C290%2C305%2C327%2C225%2C214%2C66%2C215%2C213%2C330%2C321%2C56%2C226%2C116%2C140%2C88%2C130%2C58%2C129%2C135%2C134%2C62%2C70%2C68%2C162%2C84%2C85%2C124%2C41%2C36%2C57%2C60%2C109%2C175%2C1%2C133%2C16%2C131%2C12%2C2%2C61%2C101%2C15%2C71%2C67%2C127%2C97%2C96%2C178%2C179%2C102%2C103%2C9%2C111%2C55%2C153%2C95%2C87%2C77%2C126%2C115%2C47%2C154%2C0%2C90%2C147%2C151%2C163%2C42%2C117%2C13%2C180</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=61c1ec16984f4464d33a1282</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://docs.google.com/presentation/d/14UPU5-0UUXIdoytH_jCEZgv8N5nVO3hdkCXWTYL1Eqg/edit?usp=sharing</url>
              <origin>URL_RENDER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://docs.google.com/presentation/d/15VrqJTfbtAMog0tFAyZmMfFgAA-N93c0ZEuhT8IwA3Y/edit?usp=sharing</url>
              <origin>URL_RENDER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://docs.google.com/presentation/d/18u_fHcUgCvoF-RxiQxNXdT_roEdhU5LO-RPHesA9gs8/edit?usp=sharing</url>
              <origin>URL_RENDER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://drive.google.com/file/d/10q7jM2tG9k-SfpqhoaFLpTVRSvYQzG2Z/view?usp=drive_link</url>
              <origin>URL_RENDER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://drive.google.com/file/d/1AT2AKTE1rK59jNY2yBbdHYC6_JwwhkE2/view?usp=sharing</url>
              <origin>URL_RENDER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://drive.google.com/file/d/1NYgVreF0PZWndiiK1Qgx91-MNRkyk0R7/view?usp=drive_link</url>
              <origin>URL_RENDER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://drive.google.com/file/d/1OS1OBMV-fhpKGWFjJgffZ08gTVT_gd35/view?usp=drive_link</url>
              <origin>URL_RENDER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://drive.google.com/file/d/1Z6rOhNjXw0IN9S-04Ld0f5MRzt6zhG7u/view?usp=sharing</url>
              <origin>URL_RENDER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://drive.google.com/file/d/1bShdn-bOiqZdhOHdHFDyLqqQSXax7pVv/view?usp=sharing</url>
              <origin>URL_RENDER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://drive.google.com/file/d/1ecrZ6m4vHpcUnNbqF-lE5_dM_uXL2W7K/view?usp=sharing</url>
              <origin>URL_RENDER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://dx.mountain.com/spx</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://dx.mountain.com/spx?dxver=4.0.0&amp;shaid=67956&amp;tdr=&amp;plh=https%3A%2F%2Fwww.testimonialhero.com%2F%3Futm_content%3Dsignature_website_plain%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;cb=2251799813685248</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Manrope:ital,wght@0,400;0,700;1,400&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Inter:300,400,500,600,700%7CManrope:300,400,500,600,700</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=22500591&amp;utk=</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://gs.mountain.com/gs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.hs-analytics.net/analytics/1787267700000/22500591.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.hs-banner.com/v2/22500591/banner.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.hs-banner.com/v2/activity/view</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.hs-banner.com/v2/cf-location</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.hs-scripts.com/22500591.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.hsadspixel.net/pixels.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.hscollectedforms.net/collectedforms.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.usemessages.com/conversations-embed.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mtag-cdn.mountain.com/mtag.js?cb=1787267951038</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.ads.linkedin.com/attribution_trigger</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.ads.linkedin.com/attribution_trigger?pid=2953452&amp;time=1787267950050&amp;url=https%3A%2F%2Fwww.testimonialhero.com%2F%3Futm_content%3Dsignature_website_plain%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;conversionId=10431113&amp;tm=gtmv2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.ads.linkedin.com/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.ads.linkedin.com/collect?v=2&amp;fmt=js&amp;pid=2953452&amp;time=1787267950050&amp;conversionId=10431113&amp;url=https%3A%2F%2Fwww.testimonialhero.com%2F%3Futm_content%3Dsignature_website_plain%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;tm=gtmv2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.ads.linkedin.com/wa/?medium=fetch&amp;fmt=g</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.mountain.com/st</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.mountain.com/st?ga_tracking_id=G-Z1ESQNDDXH%3BUA-131218126-1&amp;ga_client_id=2136589544.1787267950&amp;shpt=Testimonial%20Hero%20%7C%20Video%20Testimonials%20that%20Close%20Deals%20Faster&amp;dcm_cid=2136589544.1787267950&amp;dcm_gid=1784193777.1787267950&amp;available_ga=%5B%7B%22id%22%3A%22G-Z1ESQNDDXH%22%2C%22sess_id%22%3Anull%7D%2C%7B%22id%22%3A%22UA-131218126-1%22%2C%22sess_id%22%3Anull%7D%5D&amp;ga_info=%7B%22status%22%3A%22OK%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-Z1ESQNDDXH%22%2C%22sess_id%22%3Anull%7D%2C%7B%22id%22%3A%22UA-131218126-1%22%2C%22sess_id%22%3Anull%7D%5D%2C%22hardcoded_ga%22%3A%22G-Z1ESQNDDXH%3BUA-131218126-1%22%2C%22ga_tracking_id%22%3A%22G-Z1ESQNDDXH%3BUA-131218126-1%22%2C%22ga_client_id%22%3A%222136589544.1787267950%22%2C%22shpt%22%3A%22Testimonial%20Hero%20%7C%20Video%20Testimonials%20that%20Close%20Deals%20Faster%22%2C%22dcm_cid%22%3A%222136589544.1787267950%22%2C%22dcm_gid%22%3A%221784193777.1787267950%22%2C%22ga_utm_campaign%22%3A%22aia-campaignc-AI%20audit%202.01%22%2C%22ga_utm_source%22%3A%22sas%22%2C%22ga_utm_medium%22%3A%22email%22%2C%22mntnis%22%3A%22CGl5AxFUwJAjNiJMgNJNpn8sRj4yg7s1%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A4%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%2C%22dcm_gid%22%3A%22OK%22%2C%22ga_utm_campaign%22%3A%22OK%22%2C%22ga_utm_source%22%3A%22OK%22%2C%22ga_utm_medium%22%3A%22OK%22%7D%7D&amp;hardcoded_ga=G-Z1ESQNDDXH%3BUA-131218126-1&amp;meta_tag_data=%5B%7B%22description.content%22%3A%22We%20help%20B2B%20revenue%20teams%20easily%20create%20stunning%20customer%20videos%20that%20build%20trust%20and%20close%20deals%2040%25%20faster%22%7D%5D&amp;dxver=4.0.0&amp;shaid=67956&amp;plh=https%3A%2F%2Fwww.testimonialhero.com%2F%3Futm_content%3Dsignature_website_plain%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;cb=2251799813685248&amp;hc_ga_tr_id=G-Z1ESQNDDXH%3BUA-131218126-1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.mountain.com/st?ga_tracking_id=G-Z1ESQNDDXH%3BUA-131218126-1&amp;ga_client_id=2136589544.1787267950&amp;shpt=Testimonial%20Hero%20%7C%20Video%20Testimonials%20that%20Close%20Deals%20Faster&amp;dcm_cid=2136589544.1787267950&amp;dcm_gid=1784193777.1787267950&amp;available_ga=%5B%7B%22id%22%3A%22G-Z1ESQNDDXH%22%2C%22sess_id%22%3Anull%7D%2C%7B%22id%22%3A%22UA-131218126-1%22%2C%22sess_id%22%3Anull%7D%5D&amp;ga_info=%7B%22status%22%3A%22OK%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-Z1ESQNDDXH%22%2C%22sess_id%22%3Anull%7D%2C%7B%22id%22%3A%22UA-131218126-1%22%2C%22sess_id%22%3Anull%7D%5D%2C%22hardcoded_ga%22%3A%22G-Z1ESQNDDXH%3BUA-131218126-1%22%2C%22ga_tracking_id%22%3A%22G-Z1ESQNDDXH%3BUA-131218126-1%22%2C%22ga_client_id%22%3A%222136589544.1787267950%22%2C%22shpt%22%3A%22Testimonial%20Hero%20%7C%20Video%20Testimonials%20that%20Close%20Deals%20Faster%22%2C%22dcm_cid%22%3A%222136589544.1787267950%22%2C%22dcm_gid%22%3A%221784193777.1787267950%22%2C%22ga_utm_campaign%22%3A%22aia-campaignc-AI%20audit%202.01%22%2C%22ga_utm_source%22%3A%22sas%22%2C%22ga_utm_medium%22%3A%22email%22%2C%22mntnis%22%3A%22CGl5AxFUwJAjNiJMgNJNpn8sRj4yg7s1%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A4%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%2C%22dcm_gid%22%3A%22OK%22%2C%22ga_utm_campaign%22%3A%22OK%22%2C%22ga_utm_source%22%3A%22OK%22%2C%22ga_utm_medium%22%3A%22OK%22%7D%7D&amp;hardcoded_ga=G-Z1ESQNDDXH%3BUA-131218126-1&amp;meta_tag_data=%5B%7B%22description.content%22%3A%22We%20help%20B2B%20revenue%20teams%20easily%20create%20stunning%20customer%20videos%20that%20build%20trust%20and%20close%20deals%2040%25%20faster%22%7D%5D&amp;dxver=4.0.0&amp;shaid=67956&amp;plh=https%3A%2F%2Fwww.testimonialhero.com%2F%3Futm_content%3Dsignature_website_plain%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;hc_ga_tr_id=G-Z1ESQNDDXH%3BUA-131218126-1&amp;cb=1787267951121304&amp;shguid=a68217b3-f8e7-34dc-8369-f7c118bb709d&amp;shgts=1787267951291</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://pxs.mountain.com/v1/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://r.clarity.ms/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect?v=2&amp;tid=G-Z1ESQNDDXH&amp;gtm=45je68j0v9103214513z8811381218za20gzb811381218zd811381218&amp;_p=1787267949326&amp;gcs=G100&amp;gcd=13p3pPp2p5l1&amp;npa=1&amp;dma_cps=-&amp;dma=1&amp;ecid=1924428936&amp;_eu=EgAAAGAC&amp;are=1&amp;cid=99412567.1787267950&amp;ec_mode=a&amp;frm=0&amp;ir=1&amp;pscdl=denied&amp;rcb=14&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;gaf=2&amp;_s=1&amp;tag_exp=115938466~115938469~118897920~118897930~119367802~119367810~120213116~120315470~120385423&amp;sid=1787267950&amp;sct=1&amp;seg=0&amp;dl=https%3A%2F%2Fwww.testimonialhero.com%2F%3Futm_content%3Dsignature_website_plain%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;dt=Testimonial%20Hero%20%7C%20Video%20Testimonials%20that%20Close%20Deals%20Faster&amp;en=page_view&amp;_fv=1&amp;_nsi=1&amp;_ss=1&amp;tfd=974</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scripts.clarity.ms/0.8.69/clarity.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://snap.licdn.com/li.lms-analytics/insight.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://snap.licdn.com/li.lms-analytics/insight.old.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tag.unifyintent.com/v1/YTdeyHVX5CLGPoR2nX3EHc/script.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://track.hubspot.com/__ptq.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://track.hubspot.com/__ptq.gif?k=1&amp;sd=800x600&amp;cd=24-bit&amp;cs=UTF-8&amp;ln=en-us&amp;v=1.1&amp;a=22500591&amp;pu=https%3A%2F%2Fwww.testimonialhero.com%2F%3Futm_content%3Dsignature_website_plain%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;t=Testimonial+Hero+%7C+Video+Testimonials+that+Close+Deals+Faster&amp;cts=1787267951508&amp;rv=1&amp;vi=1c60dff0f00308e2624b2c543e34aba7&amp;nc=true&amp;ce=false&amp;pt=1&amp;cc=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tracking-api.g2.com/attribution_tracking/conversions/assign</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tracking.g2crowd.com/attribution_tracking/conversions/1010346.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tracking.g2crowd.com/attribution_tracking/conversions/1010346.js?p=https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;e=</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://trust.storysnap.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ug-webapp-public-production.s3.amazonaws.com/api/js/wv-ug-6qypZ1fMCurJpfmW.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://web-script.api.sayprimer.com/v2/ingest/fail</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.clarity.ms/tag/wpfcdquwub</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.dropbox.com/customers/brian-madden</url>
              <origin>URL_RENDER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://www.facebook.com/tr/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/tr/?id=552233715552562&amp;ev=PageView&amp;dl=https%3A%2F%2Fwww.testimonialhero.com%2F%3Futm_content%3Dsignature_website_plain%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;rl=&amp;if=false&amp;ts=1787267950227&amp;iw=false&amp;sw=800&amp;sh=600&amp;v=2.9.383&amp;r=stable&amp;a=plwebflow&amp;ec=0&amp;o=4126&amp;aems=0%3B0&amp;fbp=fb.1.1787267950216.263982706314542103&amp;cs_est=true&amp;ler=empty&amp;cdl=API_unavailable&amp;pmd[title]=Testimonial%20Hero%20%7C%20Video%20Testimonials%20that%20Close%20Deals%20Faster&amp;pmd[description]=We%20help%20B2B%20revenue%20teams%20easily%20create%20stunning%20customer%20videos%20that%20build%20trust%20and%20close%20deals%2040%25%20faster&amp;plt=526.6000003814697&amp;iss=1&amp;imft=1&amp;tz=0&amp;it=1787267949827&amp;coo=false&amp;expv2[0]=pl1&amp;expv2[1]=el2&amp;expv2[2]=bc1&amp;expv2[3]=ra2&amp;expv2[4]=rp2&amp;expv2[5]=im1&amp;expv2[6]=hf0&amp;expv2[7]=sd1&amp;expv2[8]=sp1&amp;expv2[9]=ek1&amp;expv2[10]=pc1&amp;expv2[11]=gs1&amp;expv2[12]=zs1&amp;expv2[13]=cp1&amp;expv2[14]=es1&amp;expv2[15]=ac1&amp;expv2[16]=so1&amp;expv2[17]=wc3&amp;expv2[18]=la1&amp;expv2[19]=sf1&amp;expv2[20]=da1&amp;expv2[21]=io1&amp;expv2[22]=ae1&amp;expv2[23]=sx1&amp;expv2[24]=if1&amp;expv2[25]=fd1&amp;expv2[26]=bg3&amp;expv2[27]=mg3&amp;expv2[28]=kl3&amp;expv2[29]=sg3&amp;expv2[30]=mk3&amp;expv2[31]=sn3&amp;expv2[32]=ec3&amp;expv2[33]=mp3&amp;expv2[34]=ps3&amp;expv2[35]=fx3&amp;expv2[36]=vt3&amp;rqm=GET</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.g2.com/products/testimonial-hero/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.g2.com/products/testimonial-hero/reviews</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.gong.io/blog/from-aspiration-to-achievement-how-revenue-ai-emboldens-leaders-to-embrace-the-present-and-reimagine-a-fresh-future</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google-analytics.com/analytics.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect?v=1&amp;_v=j102&amp;a=440931809&amp;t=pageview&amp;_s=1&amp;dl=https%3A%2F%2Fwww.testimonialhero.com%2F%3Futm_content%3Dsignature_website_plain%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;ul=en-us&amp;dt=Testimonial%20Hero%20%7C%20Video%20Testimonials%20that%20Close%20Deals%20Faster&amp;sr=800x600&amp;vp=1905x1080&amp;_u=YEBAAEABAAAAACAAI~&amp;jid=1296598581&amp;gjid=688366604&amp;cid=2136589544.1787267950&amp;tid=UA-131218126-1&amp;_gid=1784193777.1787267950&amp;_r=1&amp;_slc=1&amp;gtm=45He68j0n815PZFP63v811381218za200zd811381218&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938468~118897920~118897930~120315470~120385422&amp;npa=1&amp;z=177653974</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect?rcb=11&amp;frm=0&amp;apvc=1&amp;ae=g&amp;auid=1621158021.1787267950&amp;dt=Testimonial%20Hero%20%7C%20Video%20Testimonials%20that%20Close%20Deals%20Faster&amp;en=page_view&amp;dl=https%3A%2F%2Fwww.testimonialhero.com%2F%3Futm_content%3Dsignature_website_plain%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;scrsrc=www.googletagmanager.com&amp;rnd=445442165.1787267950&amp;navt=n&amp;npa=1&amp;ep.ads_data_redaction=0&amp;gtm=45He68j0v811381218za200zd811381218xea&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938468~118897920~118897930~120315470~120385422&amp;tft=1787267949978&amp;tfd=774&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-Z1ESQNDDXH&amp;cx=c&amp;gtm=4e68j0</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=GTM-5PZFP63</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.hubspot.com/case-studies/loop-and-tie</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.producthype.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.producthype.com/?ref=testimonialhero</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.storysnap.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.storysnap.com/cookie-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.storysnap.com/data-processing-addendum</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.storysnap.com/end-user-license-agreement</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.storysnap.com/main-services-terms-agreement</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.storysnap.com/privacy-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.storysnap.com/terms-of-service</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas#w-tabs-0-data-w-pane-0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas#w-tabs-0-data-w-pane-1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas#w-tabs-0-data-w-pane-2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas#w-tabs-0-data-w-pane-3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.testimonialhero.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/aae2b9a1c261/0.9551761867686998:1787263514:DJjC8d7AQba_DzS_c5DZoPVGIsM6LH7uSv3hLTT6AHM/a2e51f0a9c6fd299</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.testimonialhero.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/aae2b9a1c261/main.js?</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fast.wistia.com/embed/medias/k84r5jzeh3.json&amp;image=https://embed-ssl.wistia.com/deliveries/ac76f109e0b8943ace4875a8762812a8.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.com/embed/medias/p1wqs7r5x0.json&amp;image=https://embed-ssl.wistia.com/deliveries/a09f4349f6372b1a5501f33d64ac4765.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/2ngbw0m2tt&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/2vecxbq12q&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/8de20w5wxf&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/joq4qyrvdu&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/k84r5jzeh3&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/kje20oek6f&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/mdc2lf40un&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/mqhj49cpt0&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/of5yu1k6g6&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/p1wqs7r5x0&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/2ngbw0m2tt&amp;image=https://embed-ssl.wistia.com/deliveries/3d66bf6bb4a3796dc8173ef2bd022608.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/2vecxbq12q&amp;image=https://embed-ssl.wistia.com/deliveries/2c944dfb5dd2e79206e3a5edb70e2859.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/8de20w5wxf&amp;image=https://embed-ssl.wistia.com/deliveries/f143762908ee9e5d98628850d86850c7.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/joq4qyrvdu&amp;image=https://embed-ssl.wistia.com/deliveries/971edd048e7f2e1dff70afb8addf4c86.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/kje20oek6f&amp;image=https://embed-ssl.wistia.com/deliveries/c2aae30c8ddac123c9107d47ffcb37f6.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/mdc2lf40un&amp;image=https://embed-ssl.wistia.com/deliveries/30490efd745eabc2f3d14e80fd7b3414.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/mqhj49cpt0&amp;image=https://embed-ssl.wistia.com/deliveries/974e960edca6a78a462a61d1c9251173.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/of5yu1k6g6&amp;image=https://embed-ssl.wistia.com/deliveries/7fc0cf543048ede4fffc9f3be7e07c5a.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;cb=2251799813685248</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;cb=2251799813685248&amp;hc_ga_tr_id=G-Z1ESQNDDXH;UA-131218126-1</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;conversionId=10431113&amp;tm=gtmv2</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;dt=Testimonial</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;hc_ga_tr_id=G-Z1ESQNDDXH;UA-131218126-1&amp;cb=1787267951121304&amp;shguid=a68217b3-f8e7-34dc-8369-f7c118bb709d&amp;shgts=1787267951291</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;inline=false&amp;isFullscreen=false&amp;globalCookieOptOut=&amp;isFirstVisitorSession=true&amp;isAttachmentDisabled=false&amp;isInitialInputFocusDisabled=false&amp;enableWidgetCookieBanner=false&amp;isInCMS=false&amp;hideScrollToButton=true&amp;isIOSMobile=false</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;r=&amp;lt=527&amp;evt=pageLoad&amp;sv=2&amp;asc=D&amp;cdb=AQAQ&amp;rn=848889</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;rl=&amp;if=false&amp;ts=1787267950227&amp;iw=false&amp;sw=800&amp;sh=600&amp;v=2.9.383&amp;r=stable&amp;a=plwebflow&amp;ec=0&amp;o=4126&amp;aems=0;0&amp;fbp=fb.1.1787267950216.263982706314542103&amp;cs_est=true&amp;ler=empty&amp;cdl=API_unavailable&amp;pmd</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;scrsrc=www.googletagmanager.com&amp;rnd=445442165.1787267950&amp;navt=n&amp;npa=1&amp;ep.ads_data_redaction=0&amp;gtm=45He68j0v811381218za200zd811381218xea&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115938466~115938468~118897920~118897930~120315470~120385422&amp;tft=1787267949978&amp;tfd=774&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;t=Testimonial</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;tm=gtmv2</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;ul=en-us&amp;dt=Testimonial</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>testimonialhero.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>www.testimonialhero.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>a.usbrowserspeed.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ad.doubleclick.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ajax.googleapis.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>analytics.sayprimer.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>api.hubspot.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>api.unifyintent.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>api.usergems.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>app.hubspot.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>app.testimonialhero.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>bat.bing.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>bat.bing.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cdn.embedly.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cdn.jsdelivr.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cdn.prod.website-files.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>connect.facebook.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>d3e54v103j8qbb.cloudfront.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>docs.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>drive.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>dx.mountain.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>forms.hscollectedforms.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>gs.mountain.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>js.hs-analytics.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>js.hs-banner.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>js.hs-scripts.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>js.hsadspixel.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>js.hscollectedforms.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>js.usemessages.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mtag-cdn.mountain.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>px.ads.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>px.mountain.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>pxs.mountain.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>r.clarity.ms</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>region1.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>scripts.clarity.ms</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>snap.licdn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>tag.unifyintent.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>track.hubspot.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>tracking-api.g2.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>tracking.g2crowd.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>trust.storysnap.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ug-webapp-public-production.s3.amazonaws.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>web-script.api.sayprimer.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.clarity.ms</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.dropbox.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.g2.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.gong.io</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.hubspot.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.producthype.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.storysnap.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.testimonialhero.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.16.107.254</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.16.139.209</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.16.160.168</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.16.189.41</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.16.77.142</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.17.128.172</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.17.91.187</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.17.92.187</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.161.117</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.31.176</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.7.123</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.226.247.67</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.250.154.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.250.154.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.110.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.110.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.152.119</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.148</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>150.171.28.10</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>151.101.1.229</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>157.240.253.1</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>157.240.253.35</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>16.15.183.199</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>172.64.146.215</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>172.64.147.16</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>172.67.152.164</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>18.244.18.112</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>18.245.86.109</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.113</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>20.250.198.32</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>216.239.32.36</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>23.55.161.151</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>34.49.192.216</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>44.231.153.165</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>44.238.122.172</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>44.253.231.74</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>52.159.82.83</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>54.164.28.139</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>99.84.152.81</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
          <uuids>
            <value>
              <uuid>af20345a-d063-432d-a309-ef8210ceb37b</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://www.testimonialhero.com/?utm_content=signature_website_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas</name>
        <report_id>92ec1d76-3a33-433b-9c12-0028662945b5</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>6ed9b2d29446fd1adc7ea8e3a22cdec4aa8c92f341a4baadbbde0bef13cefe2a</id>
    <title>Analysis Report for 6ed9b2d29446fd1adc7ea8e3a22cdec4aa8c92f341a4baadbbde0bef13cefe2a</title>
    <updated>2026-08-20T23:18:06Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878babf2677ae4d366db60</_id>
        <file_type>text/html</file_type>
        <flow_id>6a878b2bf21817d7f9087816</flow_id>
        <hash>6ed9b2d29446fd1adc7ea8e3a22cdec4aa8c92f341a4baadbbde0bef13cefe2a</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero?utm_content=signature_linkedin_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://about.linkedin.com?trk=d_org_guest_company_overview_footer-about</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/gsi/button</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/gsi/button?logo_alignment=center&amp;shape=pill&amp;size=large&amp;text=continue_with&amp;theme=filled_blue&amp;type=undefined&amp;width=312px&amp;client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&amp;iframe_id=gsi_972807_220901&amp;as=hCaHi5sVWHRIy4fjpWmiEA&amp;hl=en_US</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/gsi/button?logo_alignment=center&amp;shape=pill&amp;size=large&amp;text=continue_with&amp;theme=filled_blue&amp;type=undefined&amp;width=312px&amp;client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&amp;iframe_id=gsi_972816_777499&amp;as=hCaHi5sVWHRIy4fjpWmiEA&amp;hl=en_US</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/gsi/button?logo_alignment=center&amp;shape=pill&amp;size=large&amp;text=continue_with&amp;theme=outline&amp;type=undefined&amp;width=276px&amp;client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&amp;iframe_id=gsi_972806_7706&amp;as=hCaHi5sVWHRIy4fjpWmiEA&amp;hl=en_US</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/gsi/button?logo_alignment=center&amp;shape=pill&amp;size=large&amp;text=continue_with&amp;theme=outline&amp;type=undefined&amp;width=276px&amp;client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&amp;iframe_id=gsi_972815_247321&amp;as=hCaHi5sVWHRIy4fjpWmiEA&amp;hl=en_US</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/gsi/button?logo_alignment=center&amp;shape=pill&amp;size=large&amp;text=continue_with&amp;theme=outline&amp;type=undefined&amp;width=312px&amp;client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&amp;iframe_id=gsi_972808_7297&amp;as=hCaHi5sVWHRIy4fjpWmiEA&amp;hl=en_US</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/gsi/button?logo_alignment=center&amp;shape=pill&amp;size=large&amp;text=continue_with&amp;theme=outline&amp;type=undefined&amp;width=312px&amp;client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&amp;iframe_id=gsi_972818_906293&amp;as=hCaHi5sVWHRIy4fjpWmiEA&amp;hl=en_US</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/gsi/button?logo_alignment=center&amp;shape=pill&amp;size=large&amp;text=continue_with&amp;theme=outline&amp;type=undefined&amp;width=400px&amp;client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&amp;iframe_id=gsi_972801_92164&amp;as=hCaHi5sVWHRIy4fjpWmiEA&amp;hl=en_US</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/gsi/button?logo_alignment=center&amp;shape=pill&amp;size=large&amp;text=continue_with&amp;theme=outline&amp;type=undefined&amp;width=400px&amp;client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&amp;iframe_id=gsi_972813_498579&amp;as=hCaHi5sVWHRIy4fjpWmiEA&amp;hl=en_US</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/gsi/status</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/gsi/status?client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&amp;as=hCaHi5sVWHRIy4fjpWmiEA&amp;has_opted_out_fedcm=true</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ar.linkedin.com/in/i%C3%B1aki-diaz-ugalde-277ba318b?trk=organization_guest_main-feed-card-text</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://brand.linkedin.com/policies?trk=d_org_guest_company_overview_footer-brand-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ca.linkedin.com/company/case-study-buddy?trk=similar-pages</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ca.linkedin.com/company/valuestudio-inc?trk=similar-pages</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ca.linkedin.com/in/kalmar?trk=org-employees</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://co.linkedin.com/in/marianatovarsagre/en?trk=organization_guest_main-feed-card-text</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://dms.licdn.com/playlist/vid/v2/D4D05AQE9HUzdCswEQA/mp4-720p-30fp-crf28/B4DZ8.Ylj4GkCM-/0/1783458072576?e=2147483647&amp;v=beta&amp;t=JWa_vFVFLELs_9lIIjS1G_s3-TVrIl89u3VxlndB1TY</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://dms.licdn.com/playlist/vid/v2/D4D05AQF21lzytetw-w/mp4-720p-30fp-crf28/B4DZ8.aGBcJ4CM-/0/1783458476888?e=2147483647&amp;v=beta&amp;t=nq6zvDDV6qIziGC-HwqbumJE0ZT5daDAUKHmh15e7OM</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://dms.licdn.com/playlist/vid/v2/D4D05AQFBQ2U_ycDV9g/mp4-720p-30fp-crf28/B4DZ8.XvEQGkCQ-/0/1783457850278?e=2147483647&amp;v=beta&amp;t=TSGnIy12UzdKGFkYi4qXDc1iIk5IBW8bleyHVkpSi_o</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://dms.licdn.com/playlist/vid/v2/D4D05AQFVWfKdCQPW0A/mp4-720p-30fp-crf28/B4DZ8.ZR8IHECM-/0/1783458252512?e=2147483647&amp;v=beta&amp;t=DMT76d-LO1YGeHQYm8A21-OKxXJwjsACm52WE-JebPM</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://dms.licdn.com/playlist/vid/v2/D4D05AQGu6HDlVCdwqQ/mp4-720p-30fp-crf28/B4DZ2r7BeeH8CE-/0/1776705885857?e=2147483647&amp;v=beta&amp;t=bIyquL9hmDxngT-4OTKlGdjMhNo8qeSI4T7lNhjy12E</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://dms.licdn.com/playlist/vid/v2/D4D05AQHVrLaZrUBErA/mp4-720p-30fp-crf28/B4DZ68TnSDIECM-/0/1781275739448?e=2147483647&amp;v=beta&amp;t=aeHaMFD-kofXWAY0heTnwVDddEVzveKowNviRtxm1D8</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fr.linkedin.com/company/thales?trk=organization_guest_main-feed-card-text</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://il.linkedin.com/in/johanna-rose-62411931?trk=organization_guest_main-feed-card-text</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://li.protechts.net/index.html?ts=1787267972776&amp;r_id=AAZZgsCRRht0Re5gIG3JwQ%3D%3D&amp;app_id=PXdOjV695v&amp;uc=scraping&amp;d_id=b43c42815f00adebbc07be26136134a5b6df00c414b72e4aea31ca9da603ee6e</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/C4D03AQGhRY0JdksJ4w/profile-displayphoto-shrink_100_100/profile-displayphoto-shrink_100_100/0/1556467637149?e=2147483647&amp;v=beta&amp;t=yEslUFeF8yHoPle3Rbxpw1yDe4ErjgrfAMIt5b3dHlE</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/C4E03AQHfh_pKYyDXzA/profile-displayphoto-shrink_100_100/profile-displayphoto-shrink_100_100/0/1643833195716?e=2147483647&amp;v=beta&amp;t=iucovjI-lDca6u8rHVLiA66-ZB8raRmJSb-ivLdVlsA</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/C560BAQHFJ9IFYzz1nw/company-logo_100_100/company-logo_100_100/0/1631327488696?e=2147483647&amp;v=beta&amp;t=wepOLm4kFb25Mw7AHWoEwd77UVct6jA_i6A5QNMr8IM</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D4D05AQE9HUzdCswEQA/videocover-high/B4DZ8.Ylj4GkBQ-/0/1783458067058?e=2147483647&amp;v=beta&amp;t=3X_-GuNAekxaPgsVVxwScpRGJ9a7we4VEdHrS4inCt4</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D4D05AQF21lzytetw-w/videocover-high/B4DZ8.aGBcJ4BQ-/0/1783458462586?e=2147483647&amp;v=beta&amp;t=MHKN_geLK1Jf1Wf47grByxmb4lnmJsQY0Suy9NPLUv0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D4D05AQFBQ2U_ycDV9g/videocover-high/B4DZ8.XvEQGkBU-/0/1783457843020?e=2147483647&amp;v=beta&amp;t=dJ68nr5nVrXW7PjUd7SVfvYn_J96CrcW2RVjxc_8m6g</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D4D05AQFVWfKdCQPW0A/videocover-high/B4DZ8.ZR8IHEBQ-/0/1783458247080?e=2147483647&amp;v=beta&amp;t=54YG6YfO1-OxELAYYTNH2viHC0pE9k3DttYNL1pTV8g</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D4D05AQGu6HDlVCdwqQ/feedshare-thumbnail_720_1280/B4DZ2r7BeeH8A4-/0/1776705869983?e=2147483647&amp;v=beta&amp;t=HgIVt-gZ67TkDSaxG621HQGIqVWOfqfxMdT3cHyxJvk</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D4D05AQHVrLaZrUBErA/videocover-high/B4DZ68TnSDIEBQ-/0/1781275726542?e=2147483647&amp;v=beta&amp;t=KREDh8ew72MTOPmFx5ccH90UNdtTrac_1NRTqG-LA14</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D4D0BAQEiYJ0yguU0IQ/company-logo_100_100/B4DZmljGOSGQAQ-/0/1759419065643/product_hype_logo?e=2147483647&amp;v=beta&amp;t=6qTL__UXfF6GqgI70U6ydSvIDj5tFLpjkv-SFjbsxAI</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D4D0BAQFXO4zY3vMq2Q/company-logo_200_200/B4DZmlitSlJIAM-/0/1759418963509/testimonialhero_logo?e=2147483647&amp;v=beta&amp;t=wYFJwU0zhNHXB8vp8wnQcSg4jVOqwEblKj4c0d3ftXk</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D4D0BAQGMcolHdITI1A/company-logo_100_100/B4DZmWhJLuJQBM-/0/1759166895236/storysnap_logo?e=2147483647&amp;v=beta&amp;t=KGe_2JQXYZKbbEPbvT2D58NsXeS_Zgev4A0MFLiJxCY</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D4D3DAQFdiTSDu9V_tA/image-scale_191_1128/B4DZl3fmqsJEAk-/0/1758646398598/testimonialhero_cover?e=2147483647&amp;v=beta&amp;t=cXt8PbUXmvhCB6ThtwgiX-1fol3RYKaQcuxcjdsCKQs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D5603AQEOSDMUb1FGjg/profile-displayphoto-scale_100_100/B56Zmlk2qeJ8Ac-/0/1759419527136?e=2147483647&amp;v=beta&amp;t=iWpwTNjpL-jnwhvnwjO2qEPEfayCT0Y0y0Wv7IACdqg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D560BAQFGgYeptT-aWQ/company-logo_100_100/B56Ze7ZY3oHEAQ-/0/1751195685282/valuestudio_inc_logo?e=2147483647&amp;v=beta&amp;t=jgeSl9NWhJt6-1P4gXcIVRxfa3UD7QTsaeAHIZX5zII</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D560BAQFOHi2Q0M2RVw/company-logo_100_100/company-logo_100_100/0/1738259426813?e=2147483647&amp;v=beta&amp;t=fONzfyP74jHmaJamEvl8rTYjtkvuADaC-z6CtDZ1deI</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D560BAQFjjnDAPv-q5g/company-logo_100_100/B56ZlMmHPTHkAQ-/0/1757926684483/cueboard_logo?e=2147483647&amp;v=beta&amp;t=h-HB6EcPe8FqdZQkaFsA9SloajOp7HfBuXABeXYz74E</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D560BAQG22rlVp273BA/company-logo_100_100/company-logo_100_100/0/1733505305388/directive_consulting_logo?e=2147483647&amp;v=beta&amp;t=x2S9wTkQW0YawM8e2_5GULc_RdEAjILoNRrwulrJwx0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D560BAQGVZukn_6cIBA/company-logo_100_100/company-logo_100_100/0/1712690581535/case_study_buddy_logo?e=2147483647&amp;v=beta&amp;t=0JGe3kRcH8ACjXYPesUI20aHEO4XKS9Dq2itH4dz77E</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D560BAQHrvF4SOfNHzA/company-logo_100_100/company-logo_100_100/0/1727142741074/hypertide_io_logo?e=2147483647&amp;v=beta&amp;t=In8jXGcP31ZK7kOcIFbS-mtDz9ninWhKyh6JGstZc0M</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D560BAQHsNsZY1Cr8aw/company-logo_100_100/company-logo_100_100/0/1689045942011/testimonialto_logo?e=2147483647&amp;v=beta&amp;t=5XlBkrwh1mIBmHN3mSydA8gxrjwQn27fDaWquEP6d4s</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ps.azurewaf.microsoft.com/event?correlationId=92d6217d-36e4-4acb-8532-bee3ce4257ff&amp;type=ping</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/26g24klhu4k9p8zgtz6fs4k01</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/29h8hsjuomfp50lam5ipnc3uh</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/29rdkxlvag0d3cpj96fiilbju</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/3g68cnardz6vbv25s4xdglixo</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/469pk4qwqr71px3afmm9prany</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/47d6m6cqlp1rwpmpk2rodukxv</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/49229g4q0jsla5l1xojq1wob9</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/4chtt12k98xwnba1nimld2oyg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/4zqr0f9jf98vi2nkijyc3bex2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/51paimf5863zz4wq4efe56why</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/5ofmdgombsj3cqmfn03qb7h60</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/671xosfpvk4c0kqtyl87hashi</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/6itbq3a9job40a3zgf91kry8z</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/6q2ztc8el1ffd1w46cwwgr95d</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/73lwy6uyd30a5j4qmibmkeu3u</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/7frb88uumrn0jl7oiyofxthci</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/7kb6sn3tm4cx918cx9a5jlb0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/80ndnja80f2uvg4l8sj2su82m</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/82pl4lu8lcdmvm9t7n4hoq0zi</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/8fkga714vy9b2wk5auqo5reeb</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/8wykgzgbqy0t3fnkgborvz54u</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/92eb1xekc34eklevj0io6x4ki</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/94r1rf57co3zoo13wr8n540ve</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/985sqoiudwdfnuemt74raqc27</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/9c8pery4andzj6ohjkjp54ma2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/9w7euj0n5gnk6np2akf853sm3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/admayac2rnonsqhz9v3rzwcyu</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/adzjokfylbe8pvjr9h8iv96mw</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/al2o9zrvru7aqj8e1x2rzsrca</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/axo5zvk1a9cvtefjtcfh438kr</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/c0tu4fqjzwahww3f3kaxjvd1e</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/cyolgscd0imw2ldqppkrb84vo</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/ddi43qwelxeqjxdd45pe3fvs1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/euqjj7tf5wvr33frd3x1jj9s</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/gs508lg3t2o81tq7pmcgn6m2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/iq0x9q37wj214o129ai1yjut</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://uy.linkedin.com/in/santipee?trk=organization_guest_main-feed-card-text</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.bing.com/maps?where=Boston+02101+Massachusetts+US&amp;trk=org-locations_url</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/accessibility?trk=d_org_guest_company_overview_footer-accessibility</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/abetheagency?trk=similar-pages</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/cueboard?trk=similar-pages</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/directive-consulting?trk=similar-pages</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/hypertideio?trk=similar-pages</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/ninjaone?trk=organization_guest_main-feed-card-text</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/northwest-animal-hospital?trk=organization_guest_main-feed-card-text</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/petvisor?trk=organization_guest_main-feed-card-text</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/product-hype?trk=similar-pages</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/skyscope-creative?trk=similar-pages</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/storysnap?trk=organization_guest_main-feed-card-text</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/storysnap?trk=similar-pages</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero?trk=organization_guest_main-feed-card_feed-actor-image</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero?trk=organization_guest_main-feed-card_feed-actor-name</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero?utm_content=signature_linkedin_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero?utm_content=signature_linkedin_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas#main-content</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialto?trk=similar-pages</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/games?trk=organization_guest_guest_nav_menu_games</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/help/linkedin/ask/TS-RIC-LO</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/help/linkedin/ask/TS-RIC-LO?entityUrn=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Ftestimonialhero</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/homepage-guest/manifest.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/account-executive-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/account-manager-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/analyst-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/analyst-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/animator-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/assistant-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/associate-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/associate-product-marketing-manager-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/audit-intern-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/bookkeeper-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/checker-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/chief-marketing-officer-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/client-coordinator-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/collector-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/communications-specialist-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/communications-specialist-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/computer-aided-design-drafter-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/consultant-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/content-designer-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/content-manager-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/content-writer-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/coordinator-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/copywriter-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/creative-design-manager-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/creative-lead-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/creative-specialist-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/curator-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/design-manager-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/designer-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/developer-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/development-coordinator-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/director-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/director-of-product-marketing-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/executive-director-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/executive-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/freelance-video-producer-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/global-head-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/graduate-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/head-of-marketing-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/human-resources-business-partner-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/immigration-attorney-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/manager-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/manager-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/marketing-account-manager-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/marketing-coordinator-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/marketing-manager-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/marketing-manager-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/marketing-specialist-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/marketing-specialist-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/packer-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/professor-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/project-director-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/project-manager-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/project-manager-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/salesperson-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/search-engine-optimization-specialist-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/search?trk=organization_guest_guest_nav_menu_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/social-media-manager-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/software-engineer-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/sourcer-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/sourcer-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/spanish-translator-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/specialist-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/storyteller-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/strategist-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/teacher-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/user-interface-designer-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/vice-president-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/video-editor-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/videographer-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/writer-jobs?trk=organization_guest-browse_jobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/writer-jobs?trk=organization_guest_linkster_link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/learning/search?trk=organization_guest_guest_nav_menu_learning</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/legal/cookie-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/legal/cookie-policy?trk=d_org_guest_company_overview_footer-cookie-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/legal/copyright-policy?trk=d_org_guest_company_overview_footer-copyright-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/legal/privacy-policy?trk=d_org_guest_company_overview_footer-privacy-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/legal/professional-community-policies?trk=d_org_guest_company_overview_footer-community-guide</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/legal/user-agreement?trk=d_org_guest_company_overview_footer-user-agreement</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/li/track</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/login</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/login?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;fromSignIn=true&amp;trk=organization_guest_nav-header-signin</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/login?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;fromSignIn=true&amp;trk=top-card_top-card-secondary-button-top-card-secondary-cta</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/mypreferences/g/guest-cookies</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/organization-guest/api/ingraphs/counter</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/organization-guest/api/ingraphs/gauge</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/testimonialhero_422-kilometers-in-a-year-thats-not-a-typo-activity-7494022631805960192--9Dm</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/testimonialhero_hes-onto-something-say-your-product-activity-7485325272863555584-aWa-</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/testimonialhero_hi-everyone-i%C3%B1aki-diaz-ugalde-here-director-activity-7492935364974755841-ttQX</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/testimonialhero_how-testimonial-hero-works-with-your-clients-activity-7487862021086941184-o2Iw</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/testimonialhero_in-the-world-of-high-end-vfx-technology-activity-7483875674290581504-8tP_</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/testimonialhero_most-teams-dont-skip-in-person-customer-activity-7490398714352672769-TbBk</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/testimonialhero_on-tuesday-we-talked-about-how-we-handle-activity-7491485831984168960-HpVw</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/testimonialhero_our-clients-span-saas-cybersecurity-medical-activity-7495472070454243328-OdTk</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/testimonialhero_three-years-three-renewals-heres-what-activity-7486412495474212864-sZoT</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/testimonialhero_time-for-another-team-spotlight-say-hi-activity-7488949210252263424-bEdH</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/psettings/guest-controls?trk=d_org_guest_company_overview_footer-guest-controls</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/pub/dir/+/+?trk=organization_guest_guest_nav_menu_people</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/redir/redirect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/redir/redirect?url=https%3A%2F%2Fwww%2Etestimonialhero%2Ecom&amp;urlhash=ctZl&amp;trk=about_website</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;trk=employees-blurred-section_sign-in-modal_join-link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;trk=organization_guest_contextual-sign-in-modal_join-link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;trk=organization_guest_main-feed-card_comment-cta</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;trk=organization_guest_main-feed-card_like-cta</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;trk=organization_guest_main-feed-card_share-cta</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;trk=organization_guest_main-feed-card_social-actions-comments</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;trk=organization_guest_main-feed-card_social-actions-reactions</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;trk=organization_guest_nav-header-join</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;trk=public_biz_promo-join</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fsearch%2Fresults%2Fpeople%2F%3FfacetCurrentCompany%3D%255B11254442%255D&amp;trk=org-employees_cta_face-pile-cta</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fsearch%2Fresults%2Fpeople%2F%3FfacetCurrentCompany%3D%255B11254442%255D&amp;trk=public_biz_employees-join</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/top-content?trk=organization_guest_guest_nav_menu_topContent</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/uas/request-password-reset?trk=csm-v2_forgot_password</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/uas/request-password-reset?trk=employees-blurred-section_sign-in-modal_forgot_password</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;fromSignIn=true&amp;trk=organization_guest_nav-header-signin</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;fromSignIn=true&amp;trk=top-card_top-card-secondary-button-top-card-secondary-cta</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;trk=employees-blurred-section_sign-in-modal_join-link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;trk=organization_guest_contextual-sign-in-modal_join-link</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;trk=organization_guest_main-feed-card_comment-cta</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;trk=organization_guest_main-feed-card_like-cta</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;trk=organization_guest_main-feed-card_share-cta</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;trk=organization_guest_main-feed-card_social-actions-comments</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;trk=organization_guest_main-feed-card_social-actions-reactions</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;trk=organization_guest_nav-header-join</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;trk=public_biz_promo-join</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/search/results/people/?facetCurrentCompany=%5B11254442%5D&amp;trk=org-employees_cta_face-pile-cta</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/search/results/people/?facetCurrentCompany=%5B11254442%5D&amp;trk=public_biz_employees-join</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.testimonialhero.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;fromSignIn=true&amp;trk=organization_guest_nav-header-signin</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;fromSignIn=true&amp;trk=top-card_top-card-secondary-button-top-card-secondary-cta</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;trk=employees-blurred-section_sign-in-modal_join-link</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;trk=organization_guest_main-feed-card_comment-cta</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;trk=organization_guest_main-feed-card_like-cta</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;trk=organization_guest_main-feed-card_share-cta</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;trk=organization_guest_main-feed-card_social-actions-comments</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;trk=organization_guest_main-feed-card_social-actions-reactions</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero&amp;trk=organization_guest_nav-header-join</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/search/results/people/?facetCurrentCompany=%5B11254442%5D&amp;trk=org-employees_cta_face-pile-cta</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/search/results/people/?facetCurrentCompany=%5B11254442%5D&amp;trk=public_biz_employees-join</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.testimonialhero.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://about.linkedin.com?trk=d_org_guest_company_overview_footer-about</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ar.linkedin.com/in/i%C3%B1aki-diaz-ugalde-277ba318b?trk=organization_guest_main-feed-card-text</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://brand.linkedin.com/policies?trk=d_org_guest_company_overview_footer-brand-policy</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ca.linkedin.com/company/case-study-buddy?trk=similar-pages</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ca.linkedin.com/company/valuestudio-inc?trk=similar-pages</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ca.linkedin.com/in/kalmar?trk=org-employees</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://co.linkedin.com/in/marianatovarsagre/en?trk=organization_guest_main-feed-card-text</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fr.linkedin.com/company/thales?trk=organization_guest_main-feed-card-text</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://il.linkedin.com/in/johanna-rose-62411931?trk=organization_guest_main-feed-card-text</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D4D0BAQFXO4zY3vMq2Q/company-logo_200_200/B4DZmlitSlJIAM-/0/1759418963509/testimonialhero_logo?e=2147483647&amp;v=beta&amp;t=wYFJwU0zhNHXB8vp8wnQcSg4jVOqwEblKj4c0d3ftXk</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/26g24klhu4k9p8zgtz6fs4k01</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/94r1rf57co3zoo13wr8n540ve</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/al2o9zrvru7aqj8e1x2rzsrca</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/axo5zvk1a9cvtefjtcfh438kr</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://uy.linkedin.com/in/santipee?trk=organization_guest_main-feed-card-text</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.bing.com/maps?where=Boston+02101+Massachusetts+US&amp;trk=org-locations_url</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/northwest-animal-hospital?trk=organization_guest_main-feed-card-text</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/petvisor?trk=organization_guest_main-feed-card-text</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/storysnap?trk=organization_guest_main-feed-card-text</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero?trk=organization_guest_main-feed-card_feed-actor-image</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero?trk=organization_guest_main-feed-card_feed-actor-name</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/games?trk=organization_guest_guest_nav_menu_games</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/help/linkedin/ask/TS-RIC-LO</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/help/linkedin/ask/TS-RIC-LO?entityUrn=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Ftestimonialhero</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/search?trk=organization_guest_guest_nav_menu_jobs</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/learning/search?trk=organization_guest_guest_nav_menu_learning</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/legal/cookie-policy</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/login</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/login?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;fromSignIn=true&amp;trk=organization_guest_nav-header-signin</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/login?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;fromSignIn=true&amp;trk=top-card_top-card-secondary-button-top-card-secondary-cta</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/mypreferences/g/guest-cookies</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/testimonialhero_422-kilometers-in-a-year-thats-not-a-typo-activity-7494022631805960192--9Dm</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/testimonialhero_hi-everyone-i%C3%B1aki-diaz-ugalde-here-director-activity-7492935364974755841-ttQX</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/testimonialhero_our-clients-span-saas-cybersecurity-medical-activity-7495472070454243328-OdTk</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/pub/dir/+/+?trk=organization_guest_guest_nav_menu_people</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/redir/redirect</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/redir/redirect?url=https%3A%2F%2Fwww%2Etestimonialhero%2Ecom&amp;urlhash=ctZl&amp;trk=about_website</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;trk=employees-blurred-section_sign-in-modal_join-link</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;trk=organization_guest_main-feed-card_comment-cta</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;trk=organization_guest_main-feed-card_like-cta</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;trk=organization_guest_main-feed-card_share-cta</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;trk=organization_guest_main-feed-card_social-actions-comments</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;trk=organization_guest_main-feed-card_social-actions-reactions</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Ftestimonialhero&amp;trk=organization_guest_nav-header-join</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fsearch%2Fresults%2Fpeople%2F%3FfacetCurrentCompany%3D%255B11254442%255D&amp;trk=org-employees_cta_face-pile-cta</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fsearch%2Fresults%2Fpeople%2F%3FfacetCurrentCompany%3D%255B11254442%255D&amp;trk=public_biz_employees-join</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/top-content?trk=organization_guest_guest_nav_menu_topContent</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/uas/login-submit</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/uas/request-password-reset?trk=employees-blurred-section_sign-in-modal_forgot_password</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>about.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ar.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>brand.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ca.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>co.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>fr.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>il.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>media.licdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>static.licdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>uy.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.bing.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.testimonialhero.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>about.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>accounts.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ar.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>brand.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ca.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>co.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>dms.licdn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fr.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>il.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>li.protechts.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>media.licdn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>pdp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ps.azurewaf.microsoft.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>static.licdn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>uy.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.bing.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>172.64.146.215</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>92.122.215.57</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.41.41</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.41.41</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.84</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>146.75.122.133</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>146.75.123.42</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>146.75.123.42</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>130.211.32.14</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.21.80.174</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>a4f21cecbd18f519ee3a0b28ef03c740b7099e396abb27699ffd0b8bdb978a73</SHA-256>
              <SHA-1>a6093b8854e135e2a2cea116ba223b8b34932968</SHA-1>
              <MD5>63261980f283ebb155d1003ef74ee09d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/jpeg</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>220bcb1ca2a00dad8195df3f900f82cab60fa423364e9d9aff31559947bf15ce</SHA-256>
              <SHA-1>8d52cf5d7815d3679d1cd8f326471edfe9fd9f34</SHA-1>
              <MD5>4ddcdb6a2d207dd0277856f0549bcf60</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>25e976e05a3f9026915cd60809e08a8f2378abdf2dd18e770a2e94ecf1a27dcd</SHA-256>
              <SHA-1>a471e6a696b8bb2a69a6284fca475d9c76976fa2</SHA-1>
              <MD5>387d9dc2f86d9d5123e807933c56896d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>08dd1a18-9638-479b-8094-2a076d54aaa6</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://www.linkedin.com/company/testimonialhero?utm_content=signature_linkedin_plain&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas</name>
        <report_id>2d6a5b59-dae7-49da-a0d0-779ef19e5dd6</report_id>
        <tags>
          <value>jpg</value>
          <value>html</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>5ea7ade6b366c15eca699d0df6bbd8522a4744dd0af6e8df1992645d623305a1</id>
    <title>Analysis Report for 5ea7ade6b366c15eca699d0df6bbd8522a4744dd0af6e8df1992645d623305a1</title>
    <updated>2026-08-20T23:18:06Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878bb4f2677ae4d366db63</_id>
        <file_type>text/html</file_type>
        <flow_id>6a878b2bf21817d7f9087817</flow_id>
        <hash>5ea7ade6b366c15eca699d0df6bbd8522a4744dd0af6e8df1992645d623305a1</hash>
        <iocs>
          <urls>
            <value>
              <url>https://52.22.50.55/is?cb=1787267972506</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://a.usbrowserspeed.com/cs?pid=c59fd74cbd71a58d3d354f836099a3cf5a29e8461d70dad1ea560c3559765bfc&amp;puid=usergems-6qypZ1fMCurJpfmW-3617d4351e034749a23b2dcc867141ad-3617d435_1e03_4749_a23b_2dcc867141ad-%2Fcustomers%2Fstories</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://a.usbrowserspeed.com/ncs?pid=c59fd74cbd71a58d3d354f836099a3cf5a29e8461d70dad1ea560c3559765bfc&amp;puid=usergems-6qypZ1fMCurJpfmW-3617d4351e034749a23b2dcc867141ad-3617d435_1e03_4749_a23b_2dcc867141ad-%252Fcustomers%252Fstories</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ad.doubleclick.net/ccm/s/collect?auid=1958366856.1787267972&amp;gtm=45He68j0v811381218za200zd811381218xea&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://analytics.sayprimer.com/primerAnalytics.js?clientId=a43cb8a1-4ef1-4203-8358-6bc13cacfba9</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://api.hubspot.com/livechat-public/v1/message/public?portalId=22500591&amp;conversations-embed=static-1.28067&amp;mobile=false&amp;messagesUtk=a44626a5e7fc440287307509cbf68fd8&amp;traceId=a44626a5e7fc440287307509cbf68fd8</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://api.unifyintent.com/analytics/v1/page</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://api.usergems.com/v1/flow/success</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://api.usergems.com/v1/identify/usergems</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://api.usergems.com/v1/visit</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://app.hubspot.com/conversations-visitor/22500591/threads/utk/a44626a5e7fc440287307509cbf68fd8</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://app.hubspot.com/conversations-visitor/22500591/threads/utk/a44626a5e7fc440287307509cbf68fd8?uuid=1982468813b8454db9efdb7c5ed6020d&amp;mobile=false&amp;mobileSafari=false&amp;hideWelcomeMessage=false&amp;hstc=&amp;domain=testimonialhero.com&amp;inApp53=false&amp;messagesUtk=a44626a5e7fc440287307509cbf68fd8&amp;url=https%3A%2F%2Fwww.testimonialhero.com%2Fcustomers%2Fstories%3Futm_content%3Dformat_plain_primary%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;inline=false&amp;isFullscreen=false&amp;globalCookieOptOut=&amp;isFirstVisitorSession=true&amp;isAttachmentDisabled=false&amp;isInitialInputFocusDisabled=false&amp;enableWidgetCookieBanner=false&amp;isInCMS=false&amp;hideScrollToButton=true&amp;isIOSMobile=false</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://app.testimonialhero.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.com/bat.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.com/p/action/56339939.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.net/action/0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.net/action/0?ti=56339939&amp;tm=gtm002&amp;Ver=2&amp;mid=7688f0fa-462e-405e-b397-35094468ccb3&amp;bo=2&amp;pi=918639831&amp;lg=en-US&amp;sw=800&amp;sh=600&amp;sc=24&amp;nwd=1&amp;tl=Customer%20Spotlight&amp;p=https%3A%2F%2Fwww.testimonialhero.com%2Fcustomers%2Fstories%3Futm_content%3Dformat_plain_primary%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;r=&amp;lt=419&amp;evt=pageLoad&amp;sv=2&amp;asc=D&amp;cdb=AQAQ&amp;rn=72793</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bat.bing.net/actionp/0?ti=56339939&amp;tm=gtm002&amp;Ver=2&amp;mid=7688f0fa-462e-405e-b397-35094468ccb3&amp;bo=1&amp;evt=consent&amp;src=default&amp;cdb=AQAQ&amp;asc=D</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2F0ej1ovpmcw&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2F0ej1ovpmcw&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F703dad5955518b2d6899f41e1f96257f.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2F2ijtsh1os6&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fs%2Fypcwvg1k1o37rj5&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F89c65eccea0cd299fa20903d451a4754.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2F466ayw6nne&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2F466ayw6nne&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2Ffa9b2bd5fb9c41902612a8571fa48c68.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2F652gbo8k09&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2F652gbo8k09&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F1d3e613eaf1e909615de976bbc4bf041.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2F6fiecj2sti&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2F6fiecj2sti&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F001f750caab3bbc3110e10431a7e1620.jpg%3Fimage_crop_resized%3D960x540&amp;key=96f1f04c5f4143bcb0f2e68c87d65feb&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2F6h2efcg3em&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2F6h2efcg3em&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F2a9e94d07259723058dad841529cf305.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2F785q71hilw&amp;display_name=Wistia%2C+Inc.&amp;url=http%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2F785q71hilw&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2Ff8bddb2f55f9033d828d29655fe1b8c5.jpg%3Fimage_crop_resized%3D960x540&amp;key=96f1f04c5f4143bcb0f2e68c87d65feb&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2F9f1fhz3wv0&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2F9f1fhz3wv0&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2Fdb8e2b008c91812b30dc4768e163099e.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2F9wd8jzcx1s&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2F9wd8jzcx1s&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F70b4cf8c0acd405fb60131dd387cce21.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fbwzshyb2uf&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fbwzshyb2uf&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F19676699c2a649a4d6aa33327fca3d36.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fdib0almj5s&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fs%2Fkzh3xpyv9w0kn2k&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F817e0a027429c489c31ec32a1e1e9888.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fds2ezy0x2o&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fds2ezy0x2o&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2Fabc11a7032c108c29f96ccbbaf8a3a1a.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fe2uzqvzfdl&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fe2uzqvzfdl&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F24c47c19bcb993f3e8c4f70dc2119cb1.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Feflhwae4ro&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Feflhwae4ro&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F8782f6e7a9281e8a82b5735289642c2f.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Feppnw9ur1g&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Feppnw9ur1g&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2Fec8401ebf89134abed0e094c172af8fc.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Ff1tosrjrkt&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Ff1tosrjrkt&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2Fdd91d4db8ba4efe4e4083eeb4f550685.jpg%3Fimage_crop_resized%3D960x540&amp;key=96f1f04c5f4143bcb0f2e68c87d65feb&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fh8p8r30x6d&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fh8p8r30x6d&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F8c597d129fc1741db3563267c56e96fe.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fi17x0pxgx3&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fi17x0pxgx3&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2Fee8ed703181b104e7eb3121d7da9b5ad.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fi681lwn1ly&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fi681lwn1ly&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F3be1e25306506ad4e30ec17f0da5de30.jpg%3Fimage_crop_resized%3D640x360&amp;key=96f1f04c5f4143bcb0f2e68c87d65feb&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fjhxuzu9o4o&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fjhxuzu9o4o&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F483827f7bfa70b9e793142fa5ac4cb67.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fk3q1oe07w1&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fk3q1oe07w1&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2Fd785c2d233b06932fa1f4fd341e0748d.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Floyra01zc8&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fs%2Fn5a1cq3ixlw134q&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F7542a1e27c6649c48602f6fad679ce4f.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fmc2gzh9ub5&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fmc2gzh9ub5&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2Fcb4ad9595dcc243b2eb9fa1189de0991.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fmhlt4qf8uh&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fmhlt4qf8uh&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F23c931c05402609d265b5329b276be89.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fmvx3rgny0x&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fmvx3rgny0x&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F92a357dc4bec8aceb05fadc0b76c0a6c.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fnll38b57wa&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fnll38b57wa&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F8b023576099114f0c569ddb65be64f8b.jpg%3Fimage_crop_resized%3D960x540&amp;key=96f1f04c5f4143bcb0f2e68c87d65feb&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fp4n059ktoi&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fp4n059ktoi&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F05418ac909b87824249a525f59c5d3f2.jpg%3Fimage_crop_resized%3D960x540&amp;key=96f1f04c5f4143bcb0f2e68c87d65feb&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fpqafwdcpol&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fpqafwdcpol&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2Fbac69b519b91bf7a3f6a6b3bd8d2f6f1.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fptvi0juyb4&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fptvi0juyb4&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F87eedaf0772e0cc546e78386121abafa.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fqls7me2i10&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fqls7me2i10&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F43c8cd54dba3b095a8803d5e9f297bdb.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Frsv868am1w&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Frsv868am1w&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F271623e68893644b7dfe8f87f5510133.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fsoas540ooi&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fsoas540ooi&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F7aec90fc7d179bb186142c94782793f2.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fspldt0yrra&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fspldt0yrra&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F8d0467e104144206f9973fdab53cf644.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fuurrqg7gyx&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fuurrqg7gyx&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F76c846028a788d76c2a44b905fce0ccb.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fwer5y1ie0d&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fwer5y1ie0d&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2Fb898e7f33c8aa5ace4cae07580c9e2af.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fxtx4hxz2ek&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fxtx4hxz2ek&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F1e6d1fcd8e90331912be96b49834c749.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fxyr0v9w7hy&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fxyr0v9w7hy&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2F97b67ab2d4bc291cda8aee65e88d1a3a.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fzs3ulcnctx&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fzs3ulcnctx&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2Ffefa9c87ae23627320d8db4a8d2b45aa.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Ffast.wistia.net%2Fembed%2Fiframe%2Fzzokpzdmxc&amp;display_name=Wistia%2C+Inc.&amp;url=https%3A%2F%2Ftestimonialhero.wistia.com%2Fmedias%2Fzzokpzdmxc&amp;image=https%3A%2F%2Fembed-ssl.wistia.com%2Fdeliveries%2Fbc1333a4c5af2c378a538138d97eb100.jpg%3Fimage_crop_resized%3D960x540&amp;type=text%2Fhtml&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3.4.2/dist/fp.umd.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.jsdelivr.net/npm/@finsweet/attributes-animation@1/animation.esm.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.jsdelivr.net/npm/@finsweet/attributes-cmscore@1/cmscore.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.jsdelivr.net/npm/@finsweet/attributes-cmsfilter@1/cmsfilter.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.jsdelivr.net/npm/@finsweet/attributes-toc@1/toc.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.jsdelivr.net/npm/js-cookie@2/src/js.cookie.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/61c1ec16984f4426ea3a12b1_fa-brands-400.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/61c1ec16984f4456353a12a7_fa-solid-900.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/61c4ced2dccfe63cde389b09_g2-logo-1.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/626b9db898a54510a9875970_Testimonial-Hero-Favicon-32.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/673392f4d429563c952f97a2_icons8-login-60%20(1).avif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/67367c10937bba27c4b93316_texture-1.avif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/674516454d9f03fd47ead4c1_icons8-tick%20(23).svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/68d46af9370eec9bcef8db11_TestimonialHero%20w_%20Sub-mark%20-%20Light.avif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/css/th-v2-c2f4c3.webflow.shared.908f50965.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/js/webflow.48ff7a5f.bb237d9384b51852.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/js/webflow.schunk.36b8fb49256177c8.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.prod.website-files.com/61c1ec16984f4464d33a1282/js/webflow.schunk.50508ae72ac99c7f.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://connect.facebook.net/en_US/fbevents.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://connect.facebook.net/signals/config/552233715552562</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://connect.facebook.net/signals/config/552233715552562?v=2.9.383&amp;r=stable&amp;domain=www.testimonialhero.com&amp;hme=0bf241557322ccbde3f88f73199a2e0cb29b567dd5a781d75c4457dac12f5177&amp;ex_m=113%2C218%2C164%2C25%2C78%2C79%2C156%2C74%2C73%2C11%2C174%2C98%2C19%2C148%2C136%2C43%2C81%2C86%2C144%2C169%2C176%2C29%2C17%2C30%2C31%2C32%2C34%2C52%2C157%2C83%2C121%2C21%2C23%2C48%2C44%2C46%2C45%2C91%2C100%2C104%2C119%2C155%2C158%2C50%2C120%2C27%2C24%2C128%2C75%2C40%2C160%2C159%2C161%2C152%2C150%2C28%2C39%2C63%2C118%2C171%2C76%2C20%2C123%2C89%2C72%2C22%2C93%2C94%2C125%2C92%2C146%2C145%2C149%2C105%2C170%2C173%2C38%2C53%2C122%2C51%2C8%2C4%2C5%2C7%2C6%2C3%2C99%2C110%2C177%2C185%2C232%2C80%2C245%2C244%2C243%2C14%2C26%2C37%2C59%2C112%2C65%2C10%2C69%2C106%2C107%2C108%2C114%2C139%2C35%2C33%2C141%2C142%2C143%2C138%2C137%2C165%2C82%2C168%2C166%2C167%2C54%2C64%2C132%2C18%2C172%2C49%2C291%2C292%2C290%2C305%2C327%2C225%2C214%2C66%2C215%2C213%2C330%2C321%2C56%2C226%2C116%2C140%2C88%2C130%2C58%2C129%2C135%2C134%2C62%2C70%2C68%2C162%2C84%2C85%2C124%2C41%2C36%2C57%2C60%2C109%2C175%2C1%2C133%2C16%2C131%2C12%2C2%2C61%2C101%2C15%2C71%2C67%2C127%2C97%2C96%2C178%2C179%2C102%2C103%2C9%2C111%2C55%2C153%2C95%2C87%2C77%2C126%2C115%2C47%2C154%2C0%2C90%2C147%2C151%2C163%2C42%2C117%2C13%2C180</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=61c1ec16984f4464d33a1282</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://dx.mountain.com/spx</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://dx.mountain.com/spx?dxver=4.0.0&amp;shaid=67956&amp;tdr=&amp;plh=https%3A%2F%2Fwww.testimonialhero.com%2Fcustomers%2Fstories%3Futm_content%3Dformat_plain_primary%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;cb=131072</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Manrope:ital,wght@0,400;0,700;1,400&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Inter:300,400,500,600,700%7CManrope:300,400,500,600,700</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=22500591&amp;utk=</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&amp;count=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://gs.mountain.com/gs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://j.clarity.ms/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.hs-analytics.net/analytics/1787267700000/22500591.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.hs-banner.com/v2/22500591/banner.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.hs-banner.com/v2/activity/view</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.hs-banner.com/v2/cf-location</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.hs-scripts.com/22500591.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.hsadspixel.net/pixels.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.hscollectedforms.net/collectedforms.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.usemessages.com/conversations-embed.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mtag-cdn.mountain.com/mtag.js?cb=1787267973111</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.ads.linkedin.com/attribution_trigger</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.ads.linkedin.com/attribution_trigger?pid=2953452&amp;time=1787267972511&amp;url=https%3A%2F%2Fwww.testimonialhero.com%2Fcustomers%2Fstories%3Futm_content%3Dformat_plain_primary%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;conversionId=10431113&amp;tm=gtmv2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.ads.linkedin.com/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.ads.linkedin.com/collect?v=2&amp;fmt=js&amp;pid=2953452&amp;time=1787267972511&amp;conversionId=10431113&amp;url=https%3A%2F%2Fwww.testimonialhero.com%2Fcustomers%2Fstories%3Futm_content%3Dformat_plain_primary%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;tm=gtmv2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.ads.linkedin.com/wa/?medium=fetch&amp;fmt=g</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.mountain.com/st</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.mountain.com/st?ga_tracking_id=G-Z1ESQNDDXH%3BUA-131218126-1&amp;ga_client_id=158572897.1787267972&amp;shpt=Customer%20Spotlight&amp;dcm_cid=158572897.1787267972&amp;dcm_gid=505200835.1787267972&amp;available_ga=%5B%7B%22id%22%3A%22G-Z1ESQNDDXH%22%2C%22sess_id%22%3Anull%7D%2C%7B%22id%22%3A%22UA-131218126-1%22%2C%22sess_id%22%3Anull%7D%5D&amp;ga_info=%7B%22status%22%3A%22OK%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-Z1ESQNDDXH%22%2C%22sess_id%22%3Anull%7D%2C%7B%22id%22%3A%22UA-131218126-1%22%2C%22sess_id%22%3Anull%7D%5D%2C%22hardcoded_ga%22%3A%22G-Z1ESQNDDXH%3BUA-131218126-1%22%2C%22ga_tracking_id%22%3A%22G-Z1ESQNDDXH%3BUA-131218126-1%22%2C%22ga_client_id%22%3A%22158572897.1787267972%22%2C%22shpt%22%3A%22Customer%20Spotlight%22%2C%22dcm_cid%22%3A%22158572897.1787267972%22%2C%22dcm_gid%22%3A%22505200835.1787267972%22%2C%22ga_utm_campaign%22%3A%22aia-campaignc-AI%20audit%202.01%22%2C%22ga_utm_source%22%3A%22sas%22%2C%22ga_utm_medium%22%3A%22email%22%2C%22mntnis%22%3A%22Gm7puDTA3hYquzjg9Igt7AwBshIBheuS%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A3%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%2C%22dcm_gid%22%3A%22OK%22%2C%22ga_utm_campaign%22%3A%22OK%22%2C%22ga_utm_source%22%3A%22OK%22%2C%22ga_utm_medium%22%3A%22OK%22%7D%7D&amp;hardcoded_ga=G-Z1ESQNDDXH%3BUA-131218126-1&amp;meta_tag_data=Customer%20Spotlight&amp;dxver=4.0.0&amp;shaid=67956&amp;plh=https%3A%2F%2Fwww.testimonialhero.com%2Fcustomers%2Fstories%3Futm_content%3Dformat_plain_primary%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;cb=131072&amp;hc_ga_tr_id=G-Z1ESQNDDXH%3BUA-131218126-1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.mountain.com/st?ga_tracking_id=G-Z1ESQNDDXH%3BUA-131218126-1&amp;ga_client_id=158572897.1787267972&amp;shpt=Customer%20Spotlight&amp;dcm_cid=158572897.1787267972&amp;dcm_gid=505200835.1787267972&amp;available_ga=%5B%7B%22id%22%3A%22G-Z1ESQNDDXH%22%2C%22sess_id%22%3Anull%7D%2C%7B%22id%22%3A%22UA-131218126-1%22%2C%22sess_id%22%3Anull%7D%5D&amp;ga_info=%7B%22status%22%3A%22OK%22%2C%22available_ga%22%3A%5B%7B%22id%22%3A%22G-Z1ESQNDDXH%22%2C%22sess_id%22%3Anull%7D%2C%7B%22id%22%3A%22UA-131218126-1%22%2C%22sess_id%22%3Anull%7D%5D%2C%22hardcoded_ga%22%3A%22G-Z1ESQNDDXH%3BUA-131218126-1%22%2C%22ga_tracking_id%22%3A%22G-Z1ESQNDDXH%3BUA-131218126-1%22%2C%22ga_client_id%22%3A%22158572897.1787267972%22%2C%22shpt%22%3A%22Customer%20Spotlight%22%2C%22dcm_cid%22%3A%22158572897.1787267972%22%2C%22dcm_gid%22%3A%22505200835.1787267972%22%2C%22ga_utm_campaign%22%3A%22aia-campaignc-AI%20audit%202.01%22%2C%22ga_utm_source%22%3A%22sas%22%2C%22ga_utm_medium%22%3A%22email%22%2C%22mntnis%22%3A%22Gm7puDTA3hYquzjg9Igt7AwBshIBheuS%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A3%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%2C%22dcm_gid%22%3A%22OK%22%2C%22ga_utm_campaign%22%3A%22OK%22%2C%22ga_utm_source%22%3A%22OK%22%2C%22ga_utm_medium%22%3A%22OK%22%7D%7D&amp;hardcoded_ga=G-Z1ESQNDDXH%3BUA-131218126-1&amp;meta_tag_data=Customer%20Spotlight&amp;dxver=4.0.0&amp;shaid=67956&amp;plh=https%3A%2F%2Fwww.testimonialhero.com%2Fcustomers%2Fstories%3Futm_content%3Dformat_plain_primary%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;hc_ga_tr_id=G-Z1ESQNDDXH%3BUA-131218126-1&amp;cb=1787267973193394&amp;shguid=a68217b3-f8e7-34dc-8369-f7c118bb709d&amp;shgts=1787267973322</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://pxs.mountain.com/v1/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect?v=2&amp;tid=G-Z1ESQNDDXH&amp;gtm=45je68j0v9103214513z8811381218za20gzb811381218zd811381218&amp;_p=1787267971604&amp;gcs=G100&amp;gcd=13p3pPp2p5l1&amp;npa=1&amp;dma_cps=-&amp;dma=1&amp;ecid=1492805723&amp;_eu=EgAAAGAC&amp;are=1&amp;cid=949335198.1787267972&amp;ec_mode=a&amp;frm=0&amp;ir=1&amp;pscdl=denied&amp;rcb=7&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;gaf=2&amp;_s=1&amp;tag_exp=115616985~115938465~115938469~118897920~118897930~119367802~119367810~120213116~120315470~120385423&amp;sid=1787267972&amp;sct=1&amp;seg=0&amp;dl=https%3A%2F%2Fwww.testimonialhero.com%2Fcustomers%2Fstories%3Futm_content%3Dformat_plain_primary%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;dt=Customer%20Spotlight&amp;en=page_view&amp;_fv=1&amp;_nsi=1&amp;_ss=1&amp;tfd=855</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect?v=2&amp;tid=G-Z1ESQNDDXH&amp;gtm=45je68j0v9103214513za20gzb811381218zd811381218&amp;_p=1787267971604&amp;gcs=G100&amp;gcd=13p3pPp2p5l1&amp;npa=1&amp;dma_cps=-&amp;dma=1&amp;ecid=1492805723&amp;_eu=AAgAAGAC&amp;are=1&amp;cid=949335198.1787267972&amp;frm=0&amp;ir=1&amp;pscdl=denied&amp;rcb=7&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;gaf=2&amp;_s=2&amp;tag_exp=115616985~115938465~115938469~118897920~118897930~119367802~119367810~120213116~120315470~120385423&amp;sid=1787267972&amp;sct=1&amp;seg=0&amp;dl=https%3A%2F%2Fwww.testimonialhero.com%2Fcustomers%2Fstories%3Futm_content%3Dformat_plain_primary%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;dt=Customer%20Spotlight&amp;en=Contact_Form_Submission&amp;_et=5&amp;tfd=5860</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scripts.clarity.ms/0.8.69/clarity.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://snap.licdn.com/li.lms-analytics/insight.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://snap.licdn.com/li.lms-analytics/insight.old.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tag.unifyintent.com/v1/YTdeyHVX5CLGPoR2nX3EHc/script.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://track.hubspot.com/__ptq.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://track.hubspot.com/__ptq.gif?k=1&amp;sd=800x600&amp;cd=24-bit&amp;cs=UTF-8&amp;ln=en-us&amp;v=1.1&amp;a=22500591&amp;pu=https%3A%2F%2Fwww.testimonialhero.com%2Fcustomers%2Fstories%3Futm_content%3Dformat_plain_primary%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;t=Customer+Spotlight&amp;cts=1787267974407&amp;rv=1&amp;vi=6afc8e45b81811cc9139b7210f1df4ef&amp;nc=true&amp;ce=false&amp;pt=1&amp;cc=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tracking-api.g2.com/attribution_tracking/conversions/assign</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tracking.g2crowd.com/attribution_tracking/conversions/1010346.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tracking.g2crowd.com/attribution_tracking/conversions/1010346.js?p=https://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;e=</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://trust.storysnap.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ug-webapp-public-production.s3.amazonaws.com/api/js/wv-ug-6qypZ1fMCurJpfmW.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://web-script.api.sayprimer.com/v2/ingest/fail</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.clarity.ms/tag/wpfcdquwub</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/tr/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/tr/?id=552233715552562&amp;ev=PageView&amp;dl=https%3A%2F%2Fwww.testimonialhero.com%2Fcustomers%2Fstories%3Futm_content%3Dformat_plain_primary%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;rl=&amp;if=false&amp;ts=1787267972229&amp;iw=false&amp;sw=800&amp;sh=600&amp;v=2.9.383&amp;r=stable&amp;a=plwebflow&amp;ec=0&amp;o=4126&amp;aems=0%3B0&amp;fbp=fb.1.1787267972219.649536844688820672&amp;cs_est=true&amp;ler=empty&amp;cdl=API_unavailable&amp;pmd[title]=Customer%20Spotlight&amp;plt=419.20000076293945&amp;iss=1&amp;imft=1&amp;tz=0&amp;it=1787267972096&amp;coo=false&amp;expv2[0]=pl1&amp;expv2[1]=el2&amp;expv2[2]=bc1&amp;expv2[3]=ra2&amp;expv2[4]=rp2&amp;expv2[5]=im0&amp;expv2[6]=hf1&amp;expv2[7]=sd1&amp;expv2[8]=sp1&amp;expv2[9]=ek1&amp;expv2[10]=pc1&amp;expv2[11]=gs1&amp;expv2[12]=zs1&amp;expv2[13]=cp1&amp;expv2[14]=es1&amp;expv2[15]=ac1&amp;expv2[16]=so1&amp;expv2[17]=wc3&amp;expv2[18]=la1&amp;expv2[19]=sf1&amp;expv2[20]=da1&amp;expv2[21]=io1&amp;expv2[22]=ae1&amp;expv2[23]=sx1&amp;expv2[24]=if1&amp;expv2[25]=fd1&amp;expv2[26]=bg3&amp;expv2[27]=mg3&amp;expv2[28]=kl3&amp;expv2[29]=sg3&amp;expv2[30]=mk3&amp;expv2[31]=sn3&amp;expv2[32]=ec3&amp;expv2[33]=mp3&amp;expv2[34]=ps3&amp;expv2[35]=fx3&amp;expv2[36]=vt3&amp;rqm=GET</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.g2.com/products/testimonial-hero/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.g2.com/products/testimonial-hero/reviews</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.g2.com/products/testimonial-hero/reviews/testimonial-hero-review-4102669</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.g2.com/products/testimonial-hero/reviews/testimonial-hero-review-4194688</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.g2.com/products/testimonial-hero/reviews/testimonial-hero-review-4436615</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.g2.com/products/testimonial-hero/reviews/testimonial-hero-review-4445761</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google-analytics.com/analytics.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect?v=1&amp;_v=j102&amp;a=121732893&amp;t=pageview&amp;_s=1&amp;dl=https%3A%2F%2Fwww.testimonialhero.com%2Fcustomers%2Fstories%3Futm_content%3Dformat_plain_primary%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;ul=en-us&amp;dt=Customer%20Spotlight&amp;sr=800x600&amp;vp=1905x1080&amp;_u=YEBAAEABAAAAACAAI~&amp;jid=1534798584&amp;gjid=92708507&amp;cid=158572897.1787267972&amp;tid=UA-131218126-1&amp;_gid=505200835.1787267972&amp;_r=1&amp;_slc=1&amp;gtm=45He68j0n815PZFP63v811381218za200zd811381218&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616986~115938465~115938469~118897920~118897930~120315470~120385422~120495806~120670646&amp;npa=1&amp;z=1837926617</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect?rcb=1&amp;frm=0&amp;apvc=1&amp;ae=g&amp;auid=1958366856.1787267972&amp;dt=Customer%20Spotlight&amp;en=page_view&amp;dl=https%3A%2F%2Fwww.testimonialhero.com%2Fcustomers%2Fstories%3Futm_content%3Dformat_plain_primary%26utm_id%3Daf20345a-d063-432d-a309-ef8210ceb37b%26utm_campaign%3Daia-campaignc-AI%2Baudit%2B2.01%26utm_medium%3Demail%26utm_source%3Dsas&amp;scrsrc=www.googletagmanager.com&amp;rnd=1106374453.1787267972&amp;navt=n&amp;npa=1&amp;ep.ads_data_redaction=0&amp;gtm=45He68j0v811381218za200zd811381218xea&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616986~115938465~115938469~118897920~118897930~120315470~120385422~120495806~120670646&amp;tft=1787267972181&amp;tfd=667&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-Z1ESQNDDXH&amp;cx=c&amp;gtm=4e68j0</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=GTM-5PZFP63</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/testimonialhero/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.producthype.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.producthype.com/?ref=testimonialhero</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.storysnap.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.storysnap.com/cookie-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.storysnap.com/data-processing-addendum</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.storysnap.com/end-user-license-agreement</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.storysnap.com/main-services-terms-agreement</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.storysnap.com/privacy-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.storysnap.com/terms-of-service</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.testimonialhero.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/aae2b9a1c261/0.9551761867686998:1787263514:DJjC8d7AQba_DzS_c5DZoPVGIsM6LH7uSv3hLTT6AHM/a2e51f960cf7d28a</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.testimonialhero.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/aae2b9a1c261/main.js?</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://testimonialhero.wistia.com/medias/785q71hilw&amp;image=https://embed-ssl.wistia.com/deliveries/f8bddb2f55f9033d828d29655fe1b8c5.jpg?image_crop_resized=960x540&amp;key=96f1f04c5f4143bcb0f2e68c87d65feb&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/0ej1ovpmcw&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/2ijtsh1os6&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/466ayw6nne&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/652gbo8k09&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/6fiecj2sti&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/6h2efcg3em&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/785q71hilw&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/9f1fhz3wv0&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/9wd8jzcx1s&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/bwzshyb2uf&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/dib0almj5s&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/ds2ezy0x2o&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/e2uzqvzfdl&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/eflhwae4ro&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/eppnw9ur1g&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/f1tosrjrkt&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/h8p8r30x6d&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/i17x0pxgx3&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/i681lwn1ly&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/jhxuzu9o4o&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/k3q1oe07w1&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/loyra01zc8&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/mc2gzh9ub5&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/mhlt4qf8uh&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/mvx3rgny0x&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/nll38b57wa&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/p4n059ktoi&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/pqafwdcpol&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/ptvi0juyb4&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/qls7me2i10&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/rsv868am1w&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/soas540ooi&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/spldt0yrra&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/uurrqg7gyx&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/wer5y1ie0d&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/xtx4hxz2ek&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/xyr0v9w7hy&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/zs3ulcnctx&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.net/embed/iframe/zzokpzdmxc&amp;display_name=Wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/0ej1ovpmcw&amp;image=https://embed-ssl.wistia.com/deliveries/703dad5955518b2d6899f41e1f96257f.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/466ayw6nne&amp;image=https://embed-ssl.wistia.com/deliveries/fa9b2bd5fb9c41902612a8571fa48c68.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/652gbo8k09&amp;image=https://embed-ssl.wistia.com/deliveries/1d3e613eaf1e909615de976bbc4bf041.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/6fiecj2sti&amp;image=https://embed-ssl.wistia.com/deliveries/001f750caab3bbc3110e10431a7e1620.jpg?image_crop_resized=960x540&amp;key=96f1f04c5f4143bcb0f2e68c87d65feb&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/6h2efcg3em&amp;image=https://embed-ssl.wistia.com/deliveries/2a9e94d07259723058dad841529cf305.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/9f1fhz3wv0&amp;image=https://embed-ssl.wistia.com/deliveries/db8e2b008c91812b30dc4768e163099e.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/9wd8jzcx1s&amp;image=https://embed-ssl.wistia.com/deliveries/70b4cf8c0acd405fb60131dd387cce21.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/bwzshyb2uf&amp;image=https://embed-ssl.wistia.com/deliveries/19676699c2a649a4d6aa33327fca3d36.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/ds2ezy0x2o&amp;image=https://embed-ssl.wistia.com/deliveries/abc11a7032c108c29f96ccbbaf8a3a1a.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/e2uzqvzfdl&amp;image=https://embed-ssl.wistia.com/deliveries/24c47c19bcb993f3e8c4f70dc2119cb1.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/eflhwae4ro&amp;image=https://embed-ssl.wistia.com/deliveries/8782f6e7a9281e8a82b5735289642c2f.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/eppnw9ur1g&amp;image=https://embed-ssl.wistia.com/deliveries/ec8401ebf89134abed0e094c172af8fc.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/f1tosrjrkt&amp;image=https://embed-ssl.wistia.com/deliveries/dd91d4db8ba4efe4e4083eeb4f550685.jpg?image_crop_resized=960x540&amp;key=96f1f04c5f4143bcb0f2e68c87d65feb&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/h8p8r30x6d&amp;image=https://embed-ssl.wistia.com/deliveries/8c597d129fc1741db3563267c56e96fe.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/i17x0pxgx3&amp;image=https://embed-ssl.wistia.com/deliveries/ee8ed703181b104e7eb3121d7da9b5ad.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/i681lwn1ly&amp;image=https://embed-ssl.wistia.com/deliveries/3be1e25306506ad4e30ec17f0da5de30.jpg?image_crop_resized=640x360&amp;key=96f1f04c5f4143bcb0f2e68c87d65feb&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/jhxuzu9o4o&amp;image=https://embed-ssl.wistia.com/deliveries/483827f7bfa70b9e793142fa5ac4cb67.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/k3q1oe07w1&amp;image=https://embed-ssl.wistia.com/deliveries/d785c2d233b06932fa1f4fd341e0748d.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/mc2gzh9ub5&amp;image=https://embed-ssl.wistia.com/deliveries/cb4ad9595dcc243b2eb9fa1189de0991.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/mhlt4qf8uh&amp;image=https://embed-ssl.wistia.com/deliveries/23c931c05402609d265b5329b276be89.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/mvx3rgny0x&amp;image=https://embed-ssl.wistia.com/deliveries/92a357dc4bec8aceb05fadc0b76c0a6c.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/nll38b57wa&amp;image=https://embed-ssl.wistia.com/deliveries/8b023576099114f0c569ddb65be64f8b.jpg?image_crop_resized=960x540&amp;key=96f1f04c5f4143bcb0f2e68c87d65feb&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/p4n059ktoi&amp;image=https://embed-ssl.wistia.com/deliveries/05418ac909b87824249a525f59c5d3f2.jpg?image_crop_resized=960x540&amp;key=96f1f04c5f4143bcb0f2e68c87d65feb&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/pqafwdcpol&amp;image=https://embed-ssl.wistia.com/deliveries/bac69b519b91bf7a3f6a6b3bd8d2f6f1.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/ptvi0juyb4&amp;image=https://embed-ssl.wistia.com/deliveries/87eedaf0772e0cc546e78386121abafa.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/qls7me2i10&amp;image=https://embed-ssl.wistia.com/deliveries/43c8cd54dba3b095a8803d5e9f297bdb.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/rsv868am1w&amp;image=https://embed-ssl.wistia.com/deliveries/271623e68893644b7dfe8f87f5510133.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/soas540ooi&amp;image=https://embed-ssl.wistia.com/deliveries/7aec90fc7d179bb186142c94782793f2.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/spldt0yrra&amp;image=https://embed-ssl.wistia.com/deliveries/8d0467e104144206f9973fdab53cf644.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/uurrqg7gyx&amp;image=https://embed-ssl.wistia.com/deliveries/76c846028a788d76c2a44b905fce0ccb.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/wer5y1ie0d&amp;image=https://embed-ssl.wistia.com/deliveries/b898e7f33c8aa5ace4cae07580c9e2af.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/xtx4hxz2ek&amp;image=https://embed-ssl.wistia.com/deliveries/1e6d1fcd8e90331912be96b49834c749.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/xyr0v9w7hy&amp;image=https://embed-ssl.wistia.com/deliveries/97b67ab2d4bc291cda8aee65e88d1a3a.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/zs3ulcnctx&amp;image=https://embed-ssl.wistia.com/deliveries/fefa9c87ae23627320d8db4a8d2b45aa.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/medias/zzokpzdmxc&amp;image=https://embed-ssl.wistia.com/deliveries/bc1333a4c5af2c378a538138d97eb100.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/s/kzh3xpyv9w0kn2k&amp;image=https://embed-ssl.wistia.com/deliveries/817e0a027429c489c31ec32a1e1e9888.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/s/n5a1cq3ixlw134q&amp;image=https://embed-ssl.wistia.com/deliveries/7542a1e27c6649c48602f6fad679ce4f.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://testimonialhero.wistia.com/s/ypcwvg1k1o37rj5&amp;image=https://embed-ssl.wistia.com/deliveries/89c65eccea0cd299fa20903d451a4754.jpg?image_crop_resized=960x540&amp;type=text/html&amp;schema=wistia</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;cb=131072</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;cb=131072&amp;hc_ga_tr_id=G-Z1ESQNDDXH;UA-131218126-1</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;conversionId=10431113&amp;tm=gtmv2</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;dt=Customer</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;hc_ga_tr_id=G-Z1ESQNDDXH;UA-131218126-1&amp;cb=1787267973193394&amp;shguid=a68217b3-f8e7-34dc-8369-f7c118bb709d&amp;shgts=1787267973322</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;inline=false&amp;isFullscreen=false&amp;globalCookieOptOut=&amp;isFirstVisitorSession=true&amp;isAttachmentDisabled=false&amp;isInitialInputFocusDisabled=false&amp;enableWidgetCookieBanner=false&amp;isInCMS=false&amp;hideScrollToButton=true&amp;isIOSMobile=false</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;r=&amp;lt=419&amp;evt=pageLoad&amp;sv=2&amp;asc=D&amp;cdb=AQAQ&amp;rn=72793</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;rl=&amp;if=false&amp;ts=1787267972229&amp;iw=false&amp;sw=800&amp;sh=600&amp;v=2.9.383&amp;r=stable&amp;a=plwebflow&amp;ec=0&amp;o=4126&amp;aems=0;0&amp;fbp=fb.1.1787267972219.649536844688820672&amp;cs_est=true&amp;ler=empty&amp;cdl=API_unavailable&amp;pmd</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;scrsrc=www.googletagmanager.com&amp;rnd=1106374453.1787267972&amp;navt=n&amp;npa=1&amp;ep.ads_data_redaction=0&amp;gtm=45He68j0v811381218za200zd811381218xea&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616986~115938465~115938469~118897920~118897930~120315470~120385422~120495806~120670646&amp;tft=1787267972181&amp;tfd=667&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;t=Customer</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;tm=gtmv2</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas&amp;ul=en-us&amp;dt=Customer</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>testimonialhero.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>www.testimonialhero.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>a.usbrowserspeed.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ad.doubleclick.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ajax.googleapis.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>analytics.sayprimer.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>api.hubspot.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>api.unifyintent.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>api.usergems.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>app.hubspot.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>app.testimonialhero.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>bat.bing.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>bat.bing.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cdn.embedly.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cdn.jsdelivr.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cdn.prod.website-files.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>connect.facebook.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>d3e54v103j8qbb.cloudfront.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>dx.mountain.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>forms.hscollectedforms.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>forms.hsforms.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>gs.mountain.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>j.clarity.ms</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>js.hs-analytics.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>js.hs-banner.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>js.hs-scripts.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>js.hsadspixel.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>js.hscollectedforms.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>js.usemessages.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mtag-cdn.mountain.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>px.ads.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>px.mountain.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>pxs.mountain.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>region1.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>scripts.clarity.ms</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>snap.licdn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>tag.unifyintent.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>track.hubspot.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>tracking-api.g2.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>tracking.g2crowd.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>trust.storysnap.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ug-webapp-public-production.s3.amazonaws.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>web-script.api.sayprimer.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.clarity.ms</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.g2.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.producthype.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.storysnap.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.testimonialhero.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>100.55.232.202</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.16.107.254</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.16.137.209</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.16.160.168</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.16.190.41</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.16.79.142</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.17.223.152</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.17.91.187</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.17.92.187</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.161.117</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.31.176</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.40.240</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.41.41</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.6.123</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.19.175.188</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.21.80.174</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.226.247.129</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.250.154.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.250.154.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.110.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.110.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.154.119</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.148</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>150.171.27.10</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>150.171.28.10</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>151.101.193.229</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>18.244.18.80</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>18.245.86.109</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.100</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>20.250.198.32</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>216.239.32.36</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>23.55.161.151</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>32.187.36.135</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>34.49.192.216</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>52.184.215.111</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>52.22.50.55</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>52.27.254.9</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>54.231.129.161</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>57.144.244.1</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>57.144.244.128</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>99.84.152.35</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
          <uuids>
            <value>
              <uuid>af20345a-d063-432d-a309-ef8210ceb37b</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://www.testimonialhero.com/customers/stories?utm_content=format_plain_primary&amp;utm_id=af20345a-d063-432d-a309-ef8210ceb37b&amp;utm_campaign=aia-campaignc-AI+audit+2.01&amp;utm_medium=email&amp;utm_source=sas</name>
        <report_id>c86a6ad0-1894-47b7-8548-c4464e194fba</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ef906e9585c579f5a7a0a8c553b4ae2dd92fc6471e039c6d8d1c96a323226d0c</id>
    <title>Analysis Report for ef906e9585c579f5a7a0a8c553b4ae2dd92fc6471e039c6d8d1c96a323226d0c</title>
    <updated>2026-08-20T23:18:06Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878ba5f2677ae4d366db5e</_id>
        <file_type>text/html</file_type>
        <flow_id>6a878b2bbefbfb13af7f1ae0</flow_id>
        <hash>ef906e9585c579f5a7a0a8c553b4ae2dd92fc6471e039c6d8d1c96a323226d0c</hash>
        <iocs>
          <urls>
            <value>
              <url>https://audience.constantcontact.com/preferences/unsubscribe?p=un&amp;m=001_y_e_hV3K1ppPkgIKWp_uQ%3D%3D&amp;se=0018GUoY90bbgbfjhcAdbDMlQ%3D%3D&amp;t=001EkZLEx15CcE%3D&amp;llr=thdq88hbb</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://api2.branch.io/v1/open</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://api2.branch.io/v1/pageview</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://app.link/_r?sdk=web2.86.5&amp;branch_key=key_live_dBpHjwdjCmRqsSbYX3ko6amiurn4jtRc&amp;callback=branch_callback__0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0-_n9m5px5iz_.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0-d1mfs180qz2.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0.oswuyhmm9g9.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/00_5nk7vmb8m~.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/00j.ot7yc7k_5.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/02vyfn7bwa8mw.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/03cdezwv1e~.o.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/048jkje8nzdq~.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/04irr~9clu6fs.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/04qhnguo_4hpa.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/06bmdh8h0.sh_.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/06ipk~x_lyga2.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/06wff9q~1nyhf.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/07emkqda14m1_.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/08cewkxllp54b.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/08gbe8jfsej1k.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0942fi9gvunku.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/09vj77fuju988.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0_y97u-02owxh.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0bd0l4ie-riyh.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0bgig70195bsl.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0c89tvr5z~~24.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0d3yyr2cf6f21.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0dc8p46~2n0xx.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0dnqj3zgrpd~v.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0dtc-0rq9fdrs.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0exnhei5t1w4d.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0gsq7ks_q713_.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0h-.eu~7x_0o9.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0hka_1_02_e3b.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0hsw17n6mjhgk.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0je9~2.t1i3d..js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0jw8powbg7dc~.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0kp.m4ynqmlfo.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0kxjo9g.7kbw2.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0lsa0z8loqdyv.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0m.m1ct_0vpf-.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0m.~_3ev4l5a2.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0nj41uvrz_f3p.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0nj7fsvulu_cn.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0odibnqlmnp9b.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0otaib3lcupnl.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0pae~byf5b.tu.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0pxhb063~vwwv.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0p~mgoyftma5..js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0qe9g-ehfrwfc.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0qkiomp.wrr-o.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0r1.wn_gm.nlh.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0ty27l~ylc418.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0v.yfcy~l_2a3.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0vqx50rw-lpx8.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0wi_dkmrjpzwe.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0xupb2e8~emam.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0y.ur1jmp7t.x.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0yycazea4az27.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0z1em8c334.ue.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0zfw-be3_f0iq.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0~ju_1v__74xg.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0~w8.ftpus7ri.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/0~xlpv4srg0bs.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/11s2_k7bgj_ec.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/11xvwlyj4.kwh.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/121x1~~-rcen..js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/13h9a4.lxhop~.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/14u.j_r.ui-ks.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/15eq78w-a5zd0.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/16zfr076si0lf.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/17ycihz0xwbps.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/186ji7cnwz~3~.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/chunks/turbopack-0.7lrjpzlr8-k.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/media/CTSans_Regular-s.0mc-0~5jozyyc.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/_next/static/media/CTSans_Semibold-s.0zr~p8q38jn82.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/aae2b9a1c261/0.9551761867686998:1787263514:DJjC8d7AQba_DzS_c5DZoPVGIsM6LH7uSv3hLTT6AHM/a2e51f9619c418e3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/aae2b9a1c261/main.js?</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/icon.ico?icon.0xn-_kosg.h--.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/preferences/unsubscribe?p=un&amp;m=001_y_e_hV3K1ppPkgIKWp_uQ%3D%3D&amp;se=0018GUoY90bbgbfjhcAdbDMlQ%3D%3D&amp;t=001EkZLEx15CcE%3D&amp;llr=thdq88hbb</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://audience.constantcontact.com/v1/preferences/unsubscribe?p=un&amp;m=001_y_e_hV3K1ppPkgIKWp_uQ%3D%3D&amp;se=0018GUoY90bbgbfjhcAdbDMlQ%3D%3D&amp;t=001EkZLEx15CcE%3D&amp;llr=thdq88hbb</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://collect.tealiumiq.com/cc/main/2/i.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://collect.tealiumiq.com/cc/users/2/i.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Amatic+SC&amp;family=Bayon&amp;family=Bitter&amp;family=Caveat&amp;family=Dancing+Script&amp;family=Gasoek+One&amp;family=Inter&amp;family=Knewave&amp;family=Lato&amp;family=Libre+Baskerville&amp;family=Lobster+Two&amp;family=Merriweather&amp;family=Modak&amp;family=Montserrat&amp;family=Open+Sans&amp;family=Oswald&amp;family=Pinyon+Script&amp;family=Playfair+Display&amp;family=Poppins&amp;family=PT+Sans&amp;family=Paytone+One&amp;family=Raleway&amp;family=Roboto&amp;family=Rubik&amp;family=Sacramento&amp;family=Thasadith&amp;family=Ultra&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://region1.analytics.google.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.analytics.google.com/g/collect?v=2&amp;tid=G-14T5LGLSQ3&amp;gtm=45je68j0v876446385za200zd876446385&amp;_p=1787267972843&amp;_gaz=1&amp;gcd=13l3lPl2l1l1&amp;npa=1&amp;dma_cps=a&amp;dma=1&amp;_eu=EAAAAGAC&amp;are=1&amp;cid=718024282.1787267973&amp;frm=0&amp;ir=1&amp;pscdl=noapi&amp;rcb=10&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;gaf=2&amp;_s=1&amp;tag_exp=115938465~115938469~118897920~118897930~119367802~119367810~120315471~120385423&amp;dt=Unsubscribe&amp;sid=1787267973&amp;sct=1&amp;seg=0&amp;dl=https%3A%2F%2Faudience.constantcontact.com%2Fpreferences%2Funsubscribe%3Fp%3Dun%26m%3D001_y_e_hV3K1ppPkgIKWp_uQ%253D%253D%26se%3D0018GUoY90bbgbfjhcAdbDMlQ%253D%253D%26t%3D001EkZLEx15CcE%253D%26llr%3Dthdq88hbb&amp;en=page_view&amp;_fv=1&amp;_nsi=1&amp;_ss=1&amp;_ee=1&amp;ep.SOID_hit=&amp;ep.PUID_hit=&amp;ep.SOPS_hit=&amp;ep.event_category=page_view&amp;ep.event_label=BOS%20-%20Unsubscribe%20-%20%2Fpreferences%2Funsubscribe%20-%20View&amp;ep.event_link_name=BOS%20-%20Unsubscribe%20-%20%2Fpreferences%2Funsubscribe%20-%20View&amp;evnid=01M0GQHZQDXS7EC849E5YCCFDS&amp;tfd=1509</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://stats.g.doubleclick.net/g/collect?v=2&amp;tid=G-14T5LGLSQ3&amp;cid=718024282.1787267973&amp;gtm=45je68j0v876446385za200zd876446385&amp;rcb=10&amp;aip=1&amp;dma=1&amp;dma_cps=a&amp;gcd=13l3lPl2l1l1&amp;npa=1&amp;frm=0&amp;tag_exp=115938465~115938469~118897920~118897930~119367802~119367810~120315471~120385423</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tags.tiqcdn.com/utag/cc/ui/prod/utag.59.js?utv=ut4.54.202608201108</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tags.tiqcdn.com/utag/cc/ui/prod/utag.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tags.tiqcdn.com/utag/cc/ui/prod/utag.v.js?a=cc/ui/202608201108&amp;cb=1787267973130</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://transcend-cdn.com/cm/ceb33a79-6942-496d-82eb-e6af9c7658ef/airgap.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://transcend-cdn.com/cm/ceb33a79-6942-496d-82eb-e6af9c7658ef/cm.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://transcend-cdn.com/cm/ceb33a79-6942-496d-82eb-e6af9c7658ef/translations/en.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://transcend-cdn.com/cm/ceb33a79-6942-496d-82eb-e6af9c7658ef/ui.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://visitor-service-eu-central-1.tealiumiq.com/cc/main/01a02178ffa70022324ca80017780507400a806c00590?callback=utag.ut%5B%22writevamain%22%5D&amp;rnd=1787267973142&amp;decode_visitor_id=true</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://visitor-service-eu-central-1.tealiumiq.com/cc/users/01a02178ffa70022324ca80017780507400a806c00590ccusers?callback=utag.ut%5B%22writevausers%22%5D&amp;rnd=1787267973106&amp;decode_visitor_id=true</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.de/ads/ga-audiences?v=1&amp;t=sr&amp;slf_rd=1&amp;_r=4&amp;tid=G-14T5LGLSQ3&amp;cid=718024282.1787267973&amp;gtm=45je68j0v876446385za200zd876446385&amp;rcb=10&amp;aip=1&amp;dma=1&amp;dma_cps=a&amp;gcd=13l3lPl2l1l1&amp;npa=1&amp;frm=0&amp;tag_exp=115938465~115938469~118897920~118897930~119367802~119367810~120315471~120385423&amp;z=766732337</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-14T5LGLSQ3</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://audience.constantcontact.com/preferences/unsubscribe?p=un&amp;m=001_y_e_hV3K1ppPkgIKWp_uQ%3D%3D&amp;se=0018GUoY90bbgbfjhcAdbDMlQ%3D%3D&amp;t=001EkZLEx15CcE%3D&amp;llr=thdq88hbb&amp;en=page_view&amp;_fv=1&amp;_nsi=1&amp;_ss=1&amp;_ee=1&amp;ep.SOID_hit=&amp;ep.PUID_hit=&amp;ep.SOPS_hit=&amp;ep.event_category=page_view&amp;ep.event_label=BOS</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ai-images.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://app.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://apps.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.pendo.io/agent/static/068cb876-3743-40da-4a2e-d5c8d0f85fcf/pendo.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://clients.mindbodyonline.com/classic/...studioid=#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://code.tidio.co/usgorq7afpylbguklelrnun3aztkdoyf.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://console.ctct.me</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://contacts-ui.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ctct.social</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://distui.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://legacy-mlui.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://legacy-myaccountsvc.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://legacy-ui.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://login.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://static.ada.support/embed2.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://static.ctctcdn.com/js/distui-roster/current</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://transcend-cdn.com/cm/ceb33a79-6942-496d-82eb-e6af9c7658ef/airgap.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://visitor.constantcontact.com/do</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-14T5LGLSQ3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>api2.branch.io</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>app.link</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>audience.constantcontact.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>collect.tealiumiq.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>region1.analytics.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>stats.g.doubleclick.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>tags.tiqcdn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>transcend-cdn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>visitor-service-eu-central-1.tealiumiq.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>www.google.de</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ai-images.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>app.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>apps.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>cdn.pendo.io</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>clients.mindbodyonline.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>code.tidio.co</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>console.ctct.me</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>contacts-ui.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ctct.social</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>distui.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>legacy-mlui.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>legacy-myaccountsvc.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>legacy-ui.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>login.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>static.ada.support</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>static.ctctcdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>transcend-cdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>visitor.constantcontact.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>email@email.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>email@emailaddress.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>email@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>emma@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>jane@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>john@gmail.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>marcus@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>sam@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>sophia@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>u003eBilling@constantcontact.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>unsubscriberequest@constantcontact.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>you@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>18.66.147.60</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>172.64.144.217</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.18.36.158</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>18.244.18.8</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>208.75.122.186</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.16.233.42</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.18.41.167</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.26.0.115</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>172.64.151.98</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.19.176.239</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>172.64.151.21</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>172.64.147.213</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>34.36.213.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.18.40.238</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>142.250.154.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>172.64.147.103</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.16.234.42</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.40.238</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.250.154.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.250.154.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.156</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.13.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>143.204.181.43</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>216.239.32.36</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>52.29.40.76</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>54.192.35.45</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>63.185.66.169</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>99.84.152.101</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>76ed665dd5d43d1252d249394a81470f7bb9a1b0ac6e0bb5287acf5c4e8b2efe</SHA-256>
              <SHA-1>514790fb984e8409d4d54c942aee6c55725f84f6</SHA-1>
              <MD5>115434573bff48d77c006d5f0b042bf7</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>1b4f34d2d3839c4400473ea97373f2af1666698383089834a3acc9b315366d8e</SHA-256>
              <SHA-1>52645821fc85afe59a5cae18fefc9e01f2b8c5a4</SHA-1>
              <MD5>013d4b0aa57766187bf4cdafe396ae35</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>a824bc7739e226e1b40ea0f8c4e4f4c6f796fc3b4abfa6e9abe3bd119a30d938</SHA-256>
              <SHA-1>0dde8fd9111d807e202b2fb37f8bcc4052fd861e</SHA-1>
              <MD5>b6c792c0f58fa3ec92173c074885221f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>0a61eb4adb53249d4fee48d0ca5a14e39c29f10028111a9438a68b2ed6d5a291</SHA-256>
              <SHA-1>7fd349c0ae779fa7e236f6e294043707888cdffb</SHA-1>
              <MD5>da25391903ac7d9559ee39798cd46d76</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>e6134491cb1cd3e211b94d20b48482caeec46813007e918bc824a06f102ff021</SHA-256>
              <SHA-1>3f009ac70c08b4403406cdd038bb1a6ed94b083f</SHA-1>
              <MD5>0152ed695f4291488741d98ba066d280</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>d157a530e56af8849e37831f0da9dd98197c8ccdee6b34e4ff8301641ebfbcbc</SHA-256>
              <SHA-1>a83d47fef78c24469b973b1e2652508fb0ebb7ba</SHA-1>
              <MD5>0a71fa391bda74f9e94f16a82bc62ecb</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>fee0af0b0acf4f57cc71ecac6e3b82dcb8aac2c152a927838744b44e482ff3ef</SHA-256>
              <SHA-1>0112ae05ce6ef3c8daca1d44b3ca870746cbbc76</SHA-1>
              <MD5>d718f1f9bbf9c9084ce4facbda74f0b5</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>5b80a8fd028f2a6164c63640e42e0eda7b1ad0f55bdbc16fd28b01525288596f</SHA-256>
              <SHA-1>7e9360de2551ff4037ef4698cce9b344c4c2ef4e</SHA-1>
              <MD5>87e04361ac93487322e81fab696d95a6</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>068cb876-3743-40da-4a2e-d5c8d0f85fcf</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>ceb33a79-6942-496d-82eb-e6af9c7658ef</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://audience.constantcontact.com/preferences/unsubscribe?p=un&amp;m=001_y_e_hV3K1ppPkgIKWp_uQ%3D%3D&amp;se=0018GUoY90bbgbfjhcAdbDMlQ%3D%3D&amp;t=001EkZLEx15CcE%3D&amp;llr=thdq88hbb</name>
        <report_id>81a679ca-6353-4ce9-81ac-6faee42f4ed8</report_id>
        <tags>
          <value>html</value>
          <value>javascript</value>
          <value>xml</value>
          <value>obfuscated</value>
          <value>base64</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>49ea1cad0d9b37ff6b00f0f9fa9e1fcfcad1e56d4de196a04cd931b39794e3e3</id>
    <title>Analysis Report for 49ea1cad0d9b37ff6b00f0f9fa9e1fcfcad1e56d4de196a04cd931b39794e3e3</title>
    <updated>2026-08-20T23:18:06Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878b80f2677ae4d366db54</_id>
        <file_type>text/html</file_type>
        <flow_id>6a878b2bbefbfb13af7f1ae1</flow_id>
        <hash>49ea1cad0d9b37ff6b00f0f9fa9e1fcfcad1e56d4de196a04cd931b39794e3e3</hash>
        <iocs>
          <urls>
            <value>
              <url>https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/f/av0/rch/eih9r/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal?lang=auto</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://challenges.cloudflare.com/turnstile/v0/g/aae2b9a1c261/api.js?onload=mlyM5&amp;render=explicit</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/privacypolicy/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com?utm_source=challenge&amp;utm_campaign=m</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.constantcontact.com/cdn-cgi/challenge-platform/h/g/fo/2612873987:1787263509:soX_88YbYc2CLYRjdmlAnX3XX0RQru3DfM-KcsTTxcI/a2e51f0abc795e11/Y0RpxKlIbteOSQorFtB8ud1EMgys_iiokeQ32kUu2dg-1787267949-1.2.1.1-ktSECs8iMUkwM7aDTVfpCF6NiCwF8K55Tn2GNmyw1l.CKXl04UtTN0lQTcINV0mY</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.constantcontact.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=a2e51f0abc795e11</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.constantcontact.com/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.constantcontact.com/legal/ccsend</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.constantcontact.com/legal/ccsend?__cf_chl_rt_tk=ZfsLuDcZCLRF4yJt.JNYGV2E0f.eIlRHN80d1NQsY9g-1787267949-1.0.1.1-cU78JVwzy7Qw4KjjFdYB4EEn0J51vd89yUMrmEjbCak</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>1.0.1.1</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.constantcontact.com/legal/ccsend</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>challenges.cloudflare.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.cloudflare.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.constantcontact.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.16.207.184</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.94.41</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.95.41</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxps://www.constantcontact.com/legal/ccsend</name>
        <report_id>2db86c15-87c0-49df-8e12-fcffb84d775f</report_id>
        <tags>
          <value>html</value>
          <value>aidetect</value>
          <value>phishing</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8b8a6d063f803d85038312166860e394fae310abbeb9d4db5df04e778273af94</id>
    <title>Analysis Report for 8b8a6d063f803d85038312166860e394fae310abbeb9d4db5df04e778273af94</title>
    <updated>2026-08-20T23:17:59Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878b78f2677ae4d366db51</_id>
        <file_type>text/html</file_type>
        <flow_id>6a878b26befbfb13af7f1abc</flow_id>
        <hash>8b8a6d063f803d85038312166860e394fae310abbeb9d4db5df04e778273af94</hash>
        <iocs>
          <urls>
            <value>
              <url>http://trust-us.uk/PrivacyPolicy/unsub%3Fstatus%3Dsuccess</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://trust-us.uk/disclaimer/unsub%3Fstatus%3Dsuccess</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://trust-us.uk/PrivacyPolicy/unsub%3Fstatus%3Dsuccess</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://trust-us.uk/disclaimer/unsub%3Fstatus%3Dsuccess</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://trust-us.uk/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://trust-us.uk/unsub?status=success</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://trust-us.uk/unsub?status=success</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>cdn.jsdelivr.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>trust-us.uk</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>cdn.jsdelivr.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>trust-us.uk</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>103.29.182.54</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>103.29.182.54</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>151.101.193.229</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>151.101.129.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>bc25609208b4091efb8b263ee5adc2ae508641693a09a704f6b004d96f7878dd</SHA-256>
              <SHA-1>d84ad5171111886a7e72c3d455d560d63d247a75</SHA-1>
              <MD5>41ac234d51501ad917ed604da504ec79</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>a79d9dabc36d9abc140da3e53c399ada0185ae23c19c0769e931406c71579df3</SHA-256>
              <SHA-1>83064c4c55f62ccdadcb898fdfcc7d5a9fcff90a</SHA-1>
              <MD5>171e465743d6faa2aeb9e74d9aa769fd</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>7f1d37f0d90b6385354c2ac10e2bb91563c46bd7a266ed351222ebcac8496c2a</SHA-256>
              <SHA-1>b231651e0fd68bbd8758189fbd3642c462d34fa6</SHA-1>
              <MD5>fe7fdfec700d100dc745dc64d3600cb2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/css</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>aa53d582f97eb594c2a5cc5824574707f9ba9837bce3046bfa5f3556860f4e04</SHA-256>
              <SHA-1>d722fa9982da8aa48df88251bb1897f13c1db3b9</SHA-1>
              <MD5>849e6db145f2905ce210f628bddd9de5</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxp://trust-us.uk/unsub?status=success</name>
        <report_id>726b8e7a-a8f9-425b-98dd-2a5c55dcd9ae</report_id>
        <tags>
          <value>html</value>
          <value>javascript</value>
          <value>txt</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>b290449d4c3caf79bfa8e2d99079d070a7a665012d3b1e389a853192faa19f6b</id>
    <title>Analysis Report for b290449d4c3caf79bfa8e2d99079d070a7a665012d3b1e389a853192faa19f6b</title>
    <updated>2026-08-20T23:16:56Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878b11f2677ae4d366db3f</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a878ae6f21817d7f9087732</flow_id>
        <hash>b290449d4c3caf79bfa8e2d99079d070a7a665012d3b1e389a853192faa19f6b</hash>
        <iocs>
          <urls>
            <value>
              <url>http://restools.hanzify.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/SMI/2</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://bit.ly/fitgirl-repacks-site</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/CSPCA.crl0H</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/tspca.crl0H</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/DirectX0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/CSPCA.crt0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/tspca.crt0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/SMI/2</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://bit.ly/fitgirl-repacks-site</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>bit.ly</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>restools.hanzify.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crl.microsoft.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>microsoft.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>bit.ly</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>23.2.13.184</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>1.0.0.0</ip>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>67.199.248.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>109.94.209.70</ip>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>109.94.209.70</ip>
              <origin>BATCH_SCRIPT_EMULATION</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>47fdf36b56a8d927dcdd1be6e175fcd06d4fcca75fdda4d5eb8b03f2031a9b52</SHA-256>
              <SHA-1>e98b2d3a4f70be08440181982453c460167c4d7e</SHA-1>
              <MD5>3c4afeab455cb464756b45e27b9ce25d</MD5>
              <origin>PE_EMULATION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>6cda5e551d24991dfed28b2e55bcb8b541928ef04f83d1aca0467495467910fc</SHA-256>
              <SHA-1>8aee67e3d3e07081390b8b905fe3ef8a668d9636</SHA-1>
              <MD5>2894bd59ff7dee6be5f46d498cca381d</MD5>
              <origin>PE_EMULATION</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>39c965edc8f577695dadd68d6d40ace4e1e17625ca4669e3f1321b6b26e470c7</SHA-256>
              <SHA-1>315a5e4f3bc5472dea5375a986dd6f6fb35b2f17</SHA-1>
              <MD5>bcd4ebd26140038f1e45ba5c639d9ad4</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>4500a02f7883a5f16b4b8dac6dfe7e3eb43bba8ac833258fb029c2a970d82855</SHA-256>
              <SHA-1>9e50e4dc1fd1dd782b6181bd59011340486b8e3d</SHA-1>
              <MD5>b1377c69e6897fdb715452b1776fad57</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>text/x-msdos-batch</file_type>
            </value>
            <value>
              <SHA-256>52c28d2f80b18bd237de3243fdbe326ab1bd278ba52026ee524431f16aa52905</SHA-256>
              <SHA-1>39337797ead30cb51562e036eadc5f61b65c3a49</SHA-1>
              <MD5>7ad88e752ab85ccfac386ad7a25feea9</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
            <value>
              <SHA-256>651d3439fc35ad4a9cce5a04d2f8878fdf04598b50845a64ab5518b70b28c485</SHA-256>
              <SHA-1>7dac29f0b65618fb1b8f8f2c14894e166403de27</SHA-1>
              <MD5>ac0f3a233bc1ade90a257e5b78e0e03d</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d</SHA-256>
              <SHA-1>8d5fd0a741dd3fd84650e40dd3928ae1f15323cc</SHA-1>
              <MD5>f07e819ba2e46a897cfabf816d7557b2</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-msdownload; format=pe</file_type>
            </value>
            <value>
              <SHA-256>699d99dd95425a15a12947bffa8205d8fa3feb86b8b3948995a29c9348b188d1</SHA-256>
              <SHA-1>8d045b493e06010946c37bb7fb203473c337088e</SHA-1>
              <MD5>e30e3bb220ec04971d724c2fdc063349</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-msdownload; format=pe64</file_type>
            </value>
            <value>
              <SHA-256>6cf1b57d59e7111bc218dfb01dda93ac0f776715599a1c69f89035bd20c16a10</SHA-256>
              <SHA-1>d37c2b3927946ed617455b3c5913fcab0bc1af52</SHA-1>
              <MD5>b4202f7fe985b9648b4676e6f70832bd</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <SHA-256>ec9c1910ddadae8ff982ca85e0af5d2b53d7b8de9d0ae3005356ac6ff8c840cf</SHA-256>
              <SHA-1>9837c7c925d8624aaf47b9e677fffc996c0b7dec</SHA-1>
              <MD5>d3fc952785eee13470884330207e2b98</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>text/x-innosetup</file_type>
            </value>
            <value>
              <SHA-256>ed79c8f65b02ed83d5db8c355328294a73dc447f08f657312bf8f3a5b40c7494</SHA-256>
              <SHA-1>ca133f67a286f4f20282e19837b53b38a27a1caa</SHA-1>
              <MD5>56d52c503adf02184f19eee4767ef60a</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
            <value>
              <SHA-256>c76205b7c2ac9d0f3b1dfaac6bbf2d58a9800791ba3166c3ed54f5315aebb3a7</SHA-256>
              <SHA-1>1bb84ba9da0fcf6a5d8e107630e3a72e2f9bbb9f</SHA-1>
              <MD5>afdf08add1ddc0f79a4c0e4cdd9dfbed</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Delphi\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Delphi\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\</registry>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\App Paths</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\RunOnce</registry>
              <origin>EXTRACTED_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>System\CurrentControlSet\Control\Session Manager</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>System\CurrentControlSet\Control\Session Manager\FileRenameOperations</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>setup.exe</name>
        <report_id>1451ae65-e8aa-4930-bd9e-4f53355c17fd</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>packed</value>
          <value>evasive</value>
          <value>cmd</value>
          <value>lolbin</value>
          <value>adaptive-context</value>
          <value>rundll32</value>
          <value>fingerprint</value>
          <value>installer</value>
          <value>reconnaissance</value>
          <value>runonce</value>
          <value>expired-cert</value>
          <value>inno</value>
          <value>embarcadero_delphi</value>
          <value>base64</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d9faa11a9281d6b813ce0a92840087872f7b73e68a3e1dd9c2b0a09636518e6d</id>
    <title>Analysis Report for d9faa11a9281d6b813ce0a92840087872f7b73e68a3e1dd9c2b0a09636518e6d</title>
    <updated>2026-08-20T23:16:05Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878afcf2677ae4d366db39</_id>
        <file_type>text/html</file_type>
        <flow_id>6a878ab3befbfb13af7f191e</flow_id>
        <hash>d9faa11a9281d6b813ce0a92840087872f7b73e68a3e1dd9c2b0a09636518e6d</hash>
        <iocs>
          <urls>
            <value>
              <url>https://brandsoftsolutions.com/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://brandsoftsolutions.com/syz0/ZGlsaGFuaS5tYWhhZ2FtYWdlQGhpdGFjaGlnbG9iYWxhaXJwb3dlci5jb20=</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://copyme.it.com/api.js?v=20260727</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://edocsis.com/restore</url>
              <origin>URL_RENDER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>http://url1472.thestempedia.com/ls/click?upn=u001.FGqkbFq-2BgkxEv-2BwnmIpwu8bvxlPXzgqXOejK8m3iU832xRa8a8Eq3DmObgGIHzyP4REDZgA9l3hcj5CKF-2FRiMnpjLsI1bExYbUTviQbRMZz-2Bvdl9-2F1inaGhZetsqjus6RWVscB-2Bi0p8ik1-2BTZwUCLA-3D-3D251i_JeYg3-2FaSSZ-2BM2acK7X4Sim4uW-2BAHQh3-2BBcP0UVi-2Bf9mYyQ8FIvtYGwwNO-2FfQhSaLVrB5aNtQ7RBX3FnFFSAouoxzJPGEsdzMrrygNmeYPyFRezxYSx2OtSxUaqo1sYrLqGB1Q3zzOnt-2B9TuUdik-2BK0BBjGt7LNa5OQcaTX7PkulRT63vZJQXrdiYk33Cji8WXJjuWKmWGHzkEMW6qWWXX7wG747-2FBC2QQmhT5iU2UDA-3D</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>brandsoftsolutions.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>copyme.it.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>edocsis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>31.76.102.26</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>31.76.244.30</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>69.72.244.74</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxp://url1472.thestempedia.com/ls/click?upn=u001.FGqkbFq-2BgkxEv-2BwnmIpwu8bvxlPXzgqXOejK8m3iU832xRa8a8Eq3DmObgGIHzyP4REDZgA9l3hcj5CKF-2FRiMnpjLsI1bExYbUTviQbRMZz-2Bvdl9-2F1inaGhZetsqjus6RWVscB-2Bi0p8ik1-2BTZwUCLA-3D-3D251i_JeYg3-2FaSSZ-2BM2acK7X4Sim4uW-2BAHQh3-2BBcP0UVi-2Bf9mYyQ8FIvtYGwwNO-2FfQhSaLVrB5aNtQ7RBX3FnFFSAouoxzJPGEsdzMrrygNmeYPyFRezxYSx2OtSxUaqo1sYrLqGB1Q3zzOnt-2B9TuUdik-2BK0BBjGt7LNa5OQcaTX7PkulRT63vZJQXrdiYk33Cji8WXJjuWKmWGHzkEMW6qWWXX7wG747-2FBC2QQmhT5iU2UDA-3D</name>
        <report_id>b157cbfe-afec-495b-b8aa-7aeb2845dcf4</report_id>
        <tags>
          <value>html</value>
          <value>base64</value>
          <value>aidetect</value>
          <value>phishing</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a2a88dad9d8c9bf5a7bd5007b91d5d4d180e2da25f59153aab0b872d3392526d</id>
    <title>Analysis Report for a2a88dad9d8c9bf5a7bd5007b91d5d4d180e2da25f59153aab0b872d3392526d</title>
    <updated>2026-08-20T23:14:07Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878aadf2677ae4d366db2a</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a878a3df21817d7f90875de</flow_id>
        <hash>a2a88dad9d8c9bf5a7bd5007b91d5d4d180e2da25f59153aab0b872d3392526d</hash>
        <iocs>
          <urls>
            <value>
              <url>https://jrsoftware.org/ishelp/index.php?topic=setupcmdline</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://jrsoftware.org/ishelp/index.php?topic=setupcmdline</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>jrsoftware.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>jrsoftware.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>737@7E7S7.8Q8</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>75.119.223.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>15f92d0fd1147dff1db568a0a02b4fd219cd63f6fc71b33190272ec87b6e4b5b</SHA-256>
              <SHA-1>368a9a3b6874a051168f537ea993030d1bb270d0</SHA-1>
              <MD5>61117cdd792495ffdef15086cdf40666</MD5>
              <origin>PE_EMULATION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>46543f01afd5029874b6ff6dae36eb599c6e20c56bc3e6478e1f9bf6a19c0a28</SHA-256>
              <SHA-1>c8c3d1549d6fe17528c789c7c472b691d1089501</SHA-1>
              <MD5>9f47782d63d277770e3eaec97b489ecb</MD5>
              <origin>PE_EMULATION</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>034c2357cca4166b0e329d28a79b4b50100873a8560051bd2e6fc714292042fc</SHA-256>
              <SHA-1>5a69d5fe67efa50ab090fd12faa74e61e9a4c71b</SHA-1>
              <MD5>a5d661860a18b7dd04379029ea73a438</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>0357e64da75375c045b41116f732913ae7aeb19c5bce023722ff97e094f0240c</SHA-256>
              <SHA-1>7ad43bcfa8c462bce4df66ca36cb272fd0722896</SHA-1>
              <MD5>5f5fed14df06abf32cc3fd774ba75a76</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>0a2f0a8712525109ac62dbb5dac31112827dc6c497544b5ba1965a50a7161791</SHA-256>
              <SHA-1>f4a3e1aef28a023cb824c9a3eb99999e3b95ef55</SHA-1>
              <MD5>520c31577cff775701a4741752ba5828</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246</SHA-256>
              <SHA-1>7ebbbbe2d2acd8fd516f824338d254a33b69f08d</SHA-1>
              <MD5>b0ca93ceb050a2feff0b19e65072bbb5</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-msdownload</file_type>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <SHA-256>11726dcf1eebe23a1df5eb0ee2af39196b702eddd69083d646e4475335130b28</SHA-256>
              <SHA-1>d99dc22ec1b655a42c475431cc3259742d0957a4</SHA-1>
              <MD5>5ca217e52bdc6f23b43c7b6a23171e6e</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>1dc50c48d5b9d6ab7f5cfe1f9122f048705ea2f6866c7dd29ba86cdc43c70282</SHA-256>
              <SHA-1>44e6f6cd01ed3bff63cc35f789bd9760bbc3a76f</SHA-1>
              <MD5>bbebbb5d32ce104116eac7c5617647aa</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>30df4ddb7d7ff020b05c161b16bafa7002c89871d8b05d132b9c06af0a21b693</SHA-256>
              <SHA-1>ed6692f8bc77ea73fad92d754ede56781769ea23</SHA-1>
              <MD5>c68fb06fd82eca9bfbf1ac7bd2c9140c</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>3d4cb78eb7aaa7b11e9ac5aeb7e6a66a06733e155003e89a1653fb8abee8dbe6</SHA-256>
              <SHA-1>1e653e2ad46c44ce5373c7d4afd806e925d9a3d0</SHA-1>
              <MD5>2546f67456e8a65371da230b16c20f3a</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>43c55b29fb4c258d9152555f2c87e59358067cda38e847c82f56888c1aae9ff8</SHA-256>
              <SHA-1>60d254d4629edda5097e44ee51d0a4ab9c78d3ce</SHA-1>
              <MD5>112a71f85a4271263f384696eb256454</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>4e5feef14a3d6ae8202362023968fe623a7879c5504d6775df0279d95249ea8b</SHA-256>
              <SHA-1>c09c3d9fe60a7bc9a9f62340dc64f453ec5f74e0</SHA-1>
              <MD5>493f785c87ea679e5036f1def9ff7c0f</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>57ee726ed033ecc773d64a97ee0c906f24e25814291d5df0ad614ff8e79f4a3c</SHA-256>
              <SHA-1>be2d08b248916767f7380a50f9d6485e5c617b47</SHA-1>
              <MD5>fc89d316db5ef118af43b566971acdb2</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>5fcfac18758a12e0e717a5189f379922a32b5ac12f26491e638d70b54ae1dcab</SHA-256>
              <SHA-1>992e63be423f0e61093ba183f49fc0cbec790488</SHA-1>
              <MD5>56a2bcecbd3cddd6f4a35361bf4920d6</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>72d1858e2477a69e326666fcbfb0fea0e415bbf3eaf40ceb740b7be68dbaaff9</SHA-256>
              <SHA-1>ae1172f113e055fcb241c0c3dcf1dd2365c192e0</SHA-1>
              <MD5>d0de9e612f3a4443d9c5cbf087cf99ec</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>74935dab40056ec4df4b9f70fc3d5d1e74273ff02440f864c657f4b04bf025f4</SHA-256>
              <SHA-1>7e4e4d71730d380474d6981e342343febff28f25</SHA-1>
              <MD5>f41d5dd104f501563afc30415cc01f84</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>75331f5133e5abfe03e42a886169366c5713ad73ee182efc1f7f82c40d127cae</SHA-256>
              <SHA-1>ef962e9bf8dc78f23ee90e9cdd6010eff90221c2</SHA-1>
              <MD5>50a85775e95c4a7ce8de69460b2ac775</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>787a36545f790b62273163d15ded91465fbe46a10c2dc90123abe7339f7cd814</SHA-256>
              <SHA-1>1770cba2da4c9783ff8cf3ea1591368af3f982f0</SHA-1>
              <MD5>6fe76aba882abb4eb6f365d2a58fecc9</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>text/x-innosetup</file_type>
            </value>
            <value>
              <SHA-256>88d14cc6638af8a0836f6d868dfab60df92907a2d7becaefbbd7e007acb75610</SHA-256>
              <SHA-1>04f73efb0801b18f6984b14cd057fb56519cd31b</SHA-1>
              <MD5>d8090aba7197fbf9c7e2631c750965a8</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>9866d9ae41c0aba9a7f1b54ec73de8e02b7052172dc486a81ab82c3ec1a5f59a</SHA-256>
              <SHA-1>71c6f78fa8a86bd90cd80fe1b61b20cfeff26c62</SHA-1>
              <MD5>dd499e0605a046a889e1e4282d53561b</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>99676c52310db365580965ea646ece86c62951bfd97ec0aae9f738a202a90593</SHA-256>
              <SHA-1>30aded8525417e2531d5eb88bf2f868172945baa</SHA-1>
              <MD5>f321ad13d1c3f35a05d67773b4bc27d6</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>9aadc410f5ce528d1bec48b54efdf1e9e69a0e9b15d91a3eb5934e3adc93aa7d</SHA-256>
              <SHA-1>499883671281fae5114accdcdf2663fe8489f8a5</SHA-1>
              <MD5>5afbebf2a7868642ce988945ca67eeed</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>9b4fb24edd6d1d8830e272398263cdbf026b97392cc35387b991dc0248a628f9</SHA-256>
              <SHA-1>688934845f22049cb14668832efa33d45013b6b9</SHA-1>
              <MD5>598f4fe64aefab8f00bcbea4c9239abf</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>9d9edf87ca203ecc60b246cc783d54218dd0ce77d3a025d0bafc580995a4abd8</SHA-256>
              <SHA-1>626fba1825d572ea441d36363307c9935de3c565</SHA-1>
              <MD5>9929115b21c2c59348058d4190392e75</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>9e540a087924a6e64790149d735cac022640e4fa6bff6bd65f5e9f41529bf0b3</SHA-256>
              <SHA-1>9088143b19979779b2116cef38b661f72d982e19</SHA-1>
              <MD5>706450d7bba6374ca02fe167d86685cb</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>9f4a5bd0d0c306ffa3c463c5822412e954f0198a34bb54a774be05b31df64442</SHA-256>
              <SHA-1>127a42b1de4b708c638c117e6dff91ac49a1f93f</SHA-1>
              <MD5>5f1abd9c3165966afafd6ea01f89d2d2</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf</SHA-256>
              <SHA-1>a022d5c1cfdd8aace0089f3e72f2eedd41bda464</SHA-1>
              <MD5>42cf62b780813706e75fb9f2b2e8c258</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>af4ffa8e39ac2f72dc0efe9e0bb90413bb45d92209fd2279900b4628f5cf6aba</SHA-256>
              <SHA-1>de354818d3ec2ba25abbfde1e7325de4a5223124</SHA-1>
              <MD5>f267c11c83be33a53b3258d32d01c71f</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>b01497a072c041af6abd03a77124ab7780cee79d5abafcd9b86588467ceb99ed</SHA-256>
              <SHA-1>9e5500c75c74039e72a495b0e5a3cf87739ae0a3</SHA-1>
              <MD5>569cbbe1743d688999d858c594ac3846</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>ba7d38a94020b45e55b3c741119746645c28c46c7d06e9563484910ba7039412</SHA-256>
              <SHA-1>1ecde958b816962f8fcaab4e71ef7984cb2afc91</SHA-1>
              <MD5>17a5ad9871734f7261f447159661cb37</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71</SHA-256>
              <SHA-1>7f17e5e1b088fc73690888b215962fbcd395c9bd</SHA-1>
              <MD5>4feafa8b5e8cdb349125c8af0ac43974</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>ce19ace18e87b572e6912306776226af5b8e63959c61cde70a8ff05b3bbdcc41</SHA-256>
              <SHA-1>20292304fa2ef1bfdc4a1000e90a1c16d4765a96</SHA-1>
              <MD5>2e87b3c111e3073a841775c1f8ec5a90</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>d1ae6908621680b9fae17ff6e78f30850354571a27354c1f9c5d4a9bc3ebe8b4</SHA-256>
              <SHA-1>04ce54326423a8d3d94f73426d5cae2722c05873</SHA-1>
              <MD5>a37511330a19180c02c3e801c13ea3bc</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>ee1c9c194199c320c893b367602ccc7ee7270bd4395d029f727e097634f47f8c</SHA-256>
              <SHA-1>699300bceaa1256818c43fecfc8cad93a59156b2</SHA-1>
              <MD5>a04c3c368cb37c07bd5f63e7e6841ebd</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>f9bebad791ab8467cceda28aa300cc4f8d4b6879e3cde7c0765422935079bd96</SHA-256>
              <SHA-1>b5947c2b9a01f168fedb9c21f989e4277a6db093</SHA-1>
              <MD5>1e1c703134e641dc16faa068dc5d9a1c</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>adb81901042f2654154a003d72e83217aed1403ab25978494cae1df247fec716</SHA-256>
              <SHA-1>be01dc45b5dd45a6ef45a59bd99035b8f5822497</SHA-1>
              <MD5>5decd90cee87bb0ceab8762287b90be0</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <registry>
            <value>
              <registry>Software\Borland\Delphi\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\CodeGear\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Embarcadero\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Delphi\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\CodeGear\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\Embarcadero\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\Borland\Delphi\RTL</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>Setup.exe</name>
        <report_id>b1fd01f7-d44f-4cad-b878-34a3ecfbe001</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>keylogger</value>
          <value>overlay</value>
          <value>evasive</value>
          <value>fingerprint</value>
          <value>packed</value>
          <value>reconnaissance</value>
          <value>crypto</value>
          <value>installer</value>
          <value>inno</value>
          <value>embarcadero_delphi</value>
          <value>signed</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>b1a653c410f6cba64fa236613714b6d487407ae19b1816ecfa39056da72811cd</id>
    <title>Analysis Report for b1a653c410f6cba64fa236613714b6d487407ae19b1816ecfa39056da72811cd</title>
    <updated>2026-08-20T23:13:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878a1e49c2438a47b72e84</_id>
        <file_type>application/octet-stream</file_type>
        <flow_id>6a878a09f21817d7f908755b</flow_id>
        <hash>b1a653c410f6cba64fa236613714b6d487407ae19b1816ecfa39056da72811cd</hash>
        <iocs/>
        <name>classes.jsa</name>
        <report_id>f28e9fb6-3c41-43ed-8dec-5e9ceeb04830</report_id>
        <tags>
          <value>data</value>
          <value>expand</value>
          <value>lolbin</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d</id>
    <title>Analysis Report for 6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d</title>
    <updated>2026-08-20T23:13:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878aaa49c2438a47b72ea8</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a878a09f21817d7f908755b</flow_id>
        <hash>6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d</hash>
        <iocs>
          <urls>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/PKI/docs/CPS/default.htm0@</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/Docs/Repository.htm0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/windows0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>crl.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.2.13.184</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>2e60130028e02270cebcbb8f20783155809566b6c4667502907852fd6cb42928</SHA-256>
              <SHA-1>3e9778df01e6cb616656cd2946be10ffceb6c7e8</SHA-1>
              <MD5>a019d143871f33423b53f01dd3aa6139</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>api-ms-win-core-util-l1-1-0.dll</name>
        <report_id>200abbb5-28f7-4c28-a91e-1572aa3a3b9d</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>packed</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>33f4fddc181066fce06b2227bded813f95e94ed1f3d785e982c6b6b56c510c57</id>
    <title>Analysis Report for 33f4fddc181066fce06b2227bded813f95e94ed1f3d785e982c6b6b56c510c57</title>
    <updated>2026-08-20T23:13:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878ab649c2438a47b72eab</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a878a09f21817d7f908755b</flow_id>
        <hash>33f4fddc181066fce06b2227bded813f95e94ed1f3d785e982c6b6b56c510c57</hash>
        <iocs>
          <urls>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/PKI/docs/CPS/default.htm0@</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/Docs/Repository.htm0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/windows0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>crl.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>23.2.13.184</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>2e60130028e02270cebcbb8f20783155809566b6c4667502907852fd6cb42928</SHA-256>
              <SHA-1>3e9778df01e6cb616656cd2946be10ffceb6c7e8</SHA-1>
              <MD5>a019d143871f33423b53f01dd3aa6139</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>api-ms-win-core-timezone-l1-1-0.dll</name>
        <report_id>aa6b6b7a-1d29-4893-8681-3c8572f2d21d</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>packed</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8a0fecd0bd6755c8c4d154bc40daad8cbf029427fecef5df4084094a25125b8f</id>
    <title>Analysis Report for 8a0fecd0bd6755c8c4d154bc40daad8cbf029427fecef5df4084094a25125b8f</title>
    <updated>2026-08-20T23:13:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878ac249c2438a47b72eaf</_id>
        <file_type>application/octet-stream</file_type>
        <flow_id>6a878a09f21817d7f908755b</flow_id>
        <hash>8a0fecd0bd6755c8c4d154bc40daad8cbf029427fecef5df4084094a25125b8f</hash>
        <iocs/>
        <name>classes_nocoops.jsa</name>
        <report_id>bd19093b-b44a-468c-aea9-584259f1d9c4</report_id>
        <tags>
          <value>data</value>
          <value>expand</value>
          <value>lolbin</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d4b544165c60f20dd092155c43d36dacb1f84364cb8c9da2d784b99f56127a71</id>
    <title>Analysis Report for d4b544165c60f20dd092155c43d36dacb1f84364cb8c9da2d784b99f56127a71</title>
    <updated>2026-08-20T23:13:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878a9e49c2438a47b72ea5</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a878a09f21817d7f908755b</flow_id>
        <hash>d4b544165c60f20dd092155c43d36dacb1f84364cb8c9da2d784b99f56127a71</hash>
        <iocs>
          <urls>
            <value>
              <url>http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crt0_</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedRootG4.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.digicert.com/CPS0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.eclipse.org/0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cacerts.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl3.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl4.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>eclipse.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>17.0.19.0</ip>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <ip>23.11.40.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>45.60.121.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>198.41.30.198</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>7ee0babeca1e9ea14187cd52734d2183412215235556b7aa177aefdb5838b8f2</SHA-256>
              <SHA-1>b178d0d49c8ddf2623281d84f08eee6efe6117e7</SHA-1>
              <MD5>edb99577f0a7e04534110d0ea0b9bd6b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>zip.dll</name>
        <report_id>b4bdb08c-2dec-4503-83a9-b5f313fe8694</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>anti-debug</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd</id>
    <title>Analysis Report for 60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd</title>
    <updated>2026-08-20T23:13:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878ad049c2438a47b72eb2</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a878a09f21817d7f908755b</flow_id>
        <hash>60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd</hash>
        <iocs>
          <urls>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/PKI/docs/CPS/default.htm0@</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/Docs/Repository.htm0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/windows0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>crl.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>23.2.13.184</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>2e60130028e02270cebcbb8f20783155809566b6c4667502907852fd6cb42928</SHA-256>
              <SHA-1>3e9778df01e6cb616656cd2946be10ffceb6c7e8</SHA-1>
              <MD5>a019d143871f33423b53f01dd3aa6139</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>api-ms-win-core-string-l1-1-0.dll</name>
        <report_id>14738230-f3fc-41e0-bb15-7ff593cfc758</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>packed</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1</id>
    <title>Analysis Report for 9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1</title>
    <updated>2026-08-20T23:13:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878adb49c2438a47b72eb5</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a878a09f21817d7f908755b</flow_id>
        <hash>9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1</hash>
        <iocs>
          <urls>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/PKI/docs/CPS/default.htm0@</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/Docs/Repository.htm0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/windows0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>crl.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.2.13.184</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>2e60130028e02270cebcbb8f20783155809566b6c4667502907852fd6cb42928</SHA-256>
              <SHA-1>3e9778df01e6cb616656cd2946be10ffceb6c7e8</SHA-1>
              <MD5>a019d143871f33423b53f01dd3aa6139</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>api-ms-win-core-rtlsupport-l1-1-0.dll</name>
        <report_id>13d211e9-38c9-437f-be74-ad6c4768696e</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>packed</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>46015b9fab8dbf68c74f1794bd2b9abf6d2b866f5b203d5138f8d536449ce06d</id>
    <title>Analysis Report for 46015b9fab8dbf68c74f1794bd2b9abf6d2b866f5b203d5138f8d536449ce06d</title>
    <updated>2026-08-20T23:13:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878a6249c2438a47b72e94</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a878a09f21817d7f908755b</flow_id>
        <hash>46015b9fab8dbf68c74f1794bd2b9abf6d2b866f5b203d5138f8d536449ce06d</hash>
        <iocs>
          <urls>
            <value>
              <url>http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crt0_</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedRootG4.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.digicert.com/CPS0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.eclipse.org/0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cacerts.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl3.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl4.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>eclipse.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>23.11.40.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>198.41.30.198</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>17.0.19.0</ip>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <ip>45.60.121.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>fd0bef4c7154b8de2238259873fbec0832f2bbbdafd860ad39925ba2ef72c2e5</SHA-256>
              <SHA-1>1859c6347957b9e3b33a537ecc78ab925a47e36a</SHA-1>
              <MD5>81ac284008b8f69dffe245fce844cc03</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>1763a6cd2cda8fc24a6cd228f99a5449</btc_wallet>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>WinFallbackLookup.dll</name>
        <report_id>ac52f030-742a-42a2-93eb-771fe506a855</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>anti-debug</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb</id>
    <title>Analysis Report for 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb</title>
    <updated>2026-08-20T23:13:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878a6f49c2438a47b72e97</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a878a09f21817d7f908755b</flow_id>
        <hash>2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb</hash>
        <iocs>
          <urls>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/PKI/docs/CPS/default.htm0@</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/Docs/Repository.htm0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/windows0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>crl.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>23.2.13.184</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>344340295aa44f1ad30c00b3db7bfdf593b75668eb74818d59d3a626760702f7</SHA-256>
              <SHA-1>377f59a5e5577bb3f54b8ca1137b9cb22ce7a8e8</SHA-1>
              <MD5>4bb4d2969b3160cba8281f158048ae92</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>31d7a5fb1b1fea3bcaa78dbaf9d94689</btc_wallet>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>ucrtbase.dll</name>
        <report_id>066a82ec-54f0-4227-a97e-ec105a32519c</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>anti-debug</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>2362969d8a0d539fc639bee886924b0175e1dccc5dd017afd630a0e61d02d5ea</id>
    <title>Analysis Report for 2362969d8a0d539fc639bee886924b0175e1dccc5dd017afd630a0e61d02d5ea</title>
    <updated>2026-08-20T23:13:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878a7c49c2438a47b72e9b</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a878a09f21817d7f908755b</flow_id>
        <hash>2362969d8a0d539fc639bee886924b0175e1dccc5dd017afd630a0e61d02d5ea</hash>
        <iocs>
          <urls>
            <value>
              <url>http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crt0_</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedRootG4.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/SMI/2005/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/SMI/2016/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.digicert.com/CPS0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.eclipse.org/0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cacerts.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl3.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl4.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>eclipse.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>17.0.19.0</ip>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>198.41.30.198</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.11.40.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>17.0.19.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>45.60.121.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>06d48c7c101d14a58a57ef8e944c83179b99b301ecff4656e75a6fd14b8d44c9</SHA-256>
              <SHA-1>176f11bebd6dcbd8cdb49b6a25ebe9ce2d18d598</SHA-1>
              <MD5>16b23d40bd64e79f362281a41df4e473</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>0bbc8b294565f558bbc93c3858a4b20669b4bbd598c4d626de3abafc5e72ff3a</SHA-256>
              <SHA-1>6060fedcbafbb0a5b6817775d3cba5a2381bec66</SHA-1>
              <MD5>f7943a80b39404076b7578e73ee4ba83</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <btc_wallets>
            <value>
              <btc_wallet>3f9f48cb758fe3b9d41527113955214f</btc_wallet>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>keytool.exe</name>
        <report_id>b5b5fed9-25da-4651-88b7-97ec737784ad</report_id>
        <tags>
          <value>peexe</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>anti-debug</value>
          <value>anti-vm</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>3b99eb724cbbc35da1c158cc68d94b65095eaa4c772d9a1ce86678c9f07cfb72</id>
    <title>Analysis Report for 3b99eb724cbbc35da1c158cc68d94b65095eaa4c772d9a1ce86678c9f07cfb72</title>
    <updated>2026-08-20T23:13:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878a8849c2438a47b72e9f</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a878a09f21817d7f908755b</flow_id>
        <hash>3b99eb724cbbc35da1c158cc68d94b65095eaa4c772d9a1ce86678c9f07cfb72</hash>
        <iocs>
          <urls>
            <value>
              <url>http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crt0_</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedRootG4.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.digicert.com/CPS0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.eclipse.org/0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cacerts.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl3.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl4.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>eclipse.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>23.11.40.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>17.0.19.0</ip>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <ip>45.60.121.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>198.41.30.198</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>a3d6b36cb83a4ecccd46ef8e6b79b3399ad52dea3a0314223db87cf1f36c6cb4</SHA-256>
              <SHA-1>b7e2a8df33f87be59eefe7d09bf84d6540d1a1de</SHA-1>
              <MD5>3eb90ac7dce7c8fde75af4eb063c1f4a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>jsvml.dll</name>
        <report_id>0cf08cfb-4f91-4bbf-a1b7-2e461af898cf</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>anti-debug</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61</id>
    <title>Analysis Report for 7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61</title>
    <updated>2026-08-20T23:13:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878a5649c2438a47b72e8f</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a878a09f21817d7f908755b</flow_id>
        <hash>7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61</hash>
        <iocs>
          <urls>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/PKI/docs/CPS/default.htm0@</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/Docs/Repository.htm0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/windows0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>crl.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>23.2.13.184</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>2e60130028e02270cebcbb8f20783155809566b6c4667502907852fd6cb42928</SHA-256>
              <SHA-1>3e9778df01e6cb616656cd2946be10ffceb6c7e8</SHA-1>
              <MD5>a019d143871f33423b53f01dd3aa6139</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>api-ms-win-core-profile-l1-1-0.dll</name>
        <report_id>53b47cd6-4ecd-4c31-80da-77eb67757769</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>packed</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>c4267c66c433f9fe48133c87afaaeaae9db95e0a4a049c5278f347de78de19d6</id>
    <title>Analysis Report for c4267c66c433f9fe48133c87afaaeaae9db95e0a4a049c5278f347de78de19d6</title>
    <updated>2026-08-20T23:13:13Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878aa4f2677ae4d366db27</_id>
        <file_type>text/javascript</file_type>
        <flow_id>6a878a06b107fd4d6e90289b</flow_id>
        <hash>c4267c66c433f9fe48133c87afaaeaae9db95e0a4a049c5278f347de78de19d6</hash>
        <iocs>
          <urls>
            <value>
              <url>http://serverng.online/a9f3c654fdhgfdgj/raw/4e7151071c8c</url>
              <origin>POWERSHELL_EMULATION</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://serverng.online/a9f3c654fdhgfdgj/raw/4e7151071c8c</url>
              <origin>JAVASCRIPT_EMULATION</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>serverng.online</url>
              <origin>POWERSHELL_EMULATION</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>serverng.online</url>
              <origin>JAVASCRIPT_EMULATION</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>188.114.97.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>02d329ab31c5e8522871a65ec0e00d4dcd7231687761a2f9054e9d45c0c6fe6e</SHA-256>
              <SHA-1>285ce3ef14700a23934a872687b9bb9c72b2dbd3</SHA-1>
              <MD5>4553c8022218ee3d82c62d71fb250ec1</MD5>
              <origin>JAVASCRIPT_EMULATION</origin>
              <file_type>text/x-msdos-batch</file_type>
            </value>
            <value>
              <SHA-256>806e9d8542a933e44e94c867c6e34782c97f13873c6e4f8ac49cd882dc0a2f40</SHA-256>
              <SHA-1>27c9d0c0674156f442095d937810824ecb8f0c39</SHA-1>
              <MD5>f1240b7ec3a39d59b4dd2e1c5202d651</MD5>
              <origin>JAVASCRIPT_EMULATION</origin>
              <file_type>text/javascript</file_type>
            </value>
            <value>
              <SHA-256>f937b1486317da27ce454f0f960aa5f0a45a00847bd75f7bb34b51a35e558a84</SHA-256>
              <SHA-1>912970ff2a47388d20a432e4c04a84fd5ca88978</SHA-1>
              <MD5>51b3e4144944a2ce2a8a565428d46d86</MD5>
              <origin>POWERSHELL_EMULATION</origin>
              <file_type>text/x-vbscript</file_type>
            </value>
            <value>
              <SHA-256>327e4a995a821cdf40e92a652d70d242b86e580c44e9264c4c74b6efdfb7dc8c</SHA-256>
              <SHA-1>49e753d84d2105fd0d12084cfb4ad261bcc5deab</SHA-1>
              <MD5>3b3985b427c4a39f318b3fe193378ce8</MD5>
              <origin>VBA_EMULATION</origin>
              <file_type>application/x-powershell</file_type>
            </value>
            <value>
              <SHA-256>51c3dbbe59ed1cc60253feb56965868d6576c569c7b1566d7592f7e43b9ec8af</SHA-256>
              <SHA-1>2e579870fd84b66f32faa6f3dc1b084cdf8fe082</SHA-1>
              <MD5>94ff811bcb1ac33c1abe48a972076c6a</MD5>
              <origin>VBA_EMULATION</origin>
              <file_type>text/x-msdos-batch</file_type>
            </value>
            <value>
              <SHA-256>579c6ea127c6afd08430939528845522e6b3e83552751e614c4e360f1bfbfef7</SHA-256>
              <SHA-1>833aaa728a27c56f130400b4aa4686695b241d37</SHA-1>
              <MD5>277d163a39e754f5e7e69321000f8510</MD5>
              <origin>POWERSHELL_EMULATION</origin>
              <file_type>text/x-msdos-batch</file_type>
            </value>
            <value>
              <SHA-256>aee273298af9eb548d6840350c07916148678e10c2e817f57f10adb6f4ed7174</SHA-256>
              <SHA-1>ce3a34a404e8f11c767769ca4e70080bf0d340d8</SHA-1>
              <MD5>920bdf8e4edd451ddfd8027f20fec96f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <registry>
            <value>
              <registry>HKCU\Software\Microsoft\Windows\CurrentVersion\Run</registry>
              <origin>JAVASCRIPT_EMULATION</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>HKCU\Software\WinhnznxrMgr</registry>
              <origin>JAVASCRIPT_EMULATION</origin>
            </value>
            <value>
              <registry>HKCU\Software\Microsoft\Windows\CurrentVersion\Run</registry>
              <origin>POWERSHELL_EMULATION</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>HKCU\Software\WinhnznxrMgr</registry>
              <origin>POWERSHELL_EMULATION</origin>
            </value>
          </registry>
        </iocs>
        <name>c4267c66c433f9fe48133c87afaaeaae9db95e0a4a049c5278f347de78de19d6.js</name>
        <report_id>2a147e13-40ab-4198-bd6b-17c6578a43d1</report_id>
        <tags>
          <value>javascript</value>
          <value>txt</value>
          <value>anti-vm</value>
          <value>fingerprint</value>
          <value>obfuscated</value>
          <value>base64</value>
          <value>powershell</value>
          <value>anti-debug</value>
          <value>conhost</value>
          <value>encrypted</value>
          <value>persistence</value>
          <value>evasive</value>
          <value>repaired</value>
          <value>zero-day</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d52b33de0c40f7d89e2eae5aa69873b30806276a64104df9bff90fa87c0ee01f</id>
    <title>Analysis Report for d52b33de0c40f7d89e2eae5aa69873b30806276a64104df9bff90fa87c0ee01f</title>
    <updated>2026-08-20T23:11:22Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8789cbf2677ae4d366daff</_id>
        <file_type>application/vnd.android.package-archive</file_type>
        <flow_id>6a878997befbfb13af7f1672</flow_id>
        <hash>d52b33de0c40f7d89e2eae5aa69873b30806276a64104df9bff90fa87c0ee01f</hash>
        <iocs>
          <urls>
            <value>
              <url>https://api.pipepipe.dev/decoder/decode</url>
              <origin>APK_DECODING</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/exif/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/photoshop/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/tiff/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>api.pipepipe.dev</url>
              <origin>APK_DECODING</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>ns.adobe.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>2.0.4.2</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>7.0.4.2</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>188.114.97.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>138ecd05149a430c3d7e679a44bd274dce2e15a994481742ad7a52e2e43da653</SHA-256>
              <SHA-1>65ece4109439e9fc53c3b45ce518b5cbef939e28</SHA-1>
              <MD5>a02e72ace6d4ee7eb76af99f5232b3f3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>EchoMusic.apk</name>
        <report_id>26108b1e-da08-4bdb-ad02-9f3691a6a2e9</report_id>
        <tags>
          <value>apk</value>
          <value>html</value>
          <value>signed</value>
          <value>persistence</value>
          <value>base64</value>
          <value>crypto</value>
          <value>evasive</value>
          <value>fingerprint</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>c9893c40acd61de4f8a9ee10637b907d2288b8e15e6419ffaa449568fa0eb1cb</id>
    <title>Analysis Report for c9893c40acd61de4f8a9ee10637b907d2288b8e15e6419ffaa449568fa0eb1cb</title>
    <updated>2026-08-20T23:09:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878937f2677ae4d366dae4</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a87891feeadd95beca183b2</flow_id>
        <hash>c9893c40acd61de4f8a9ee10637b907d2288b8e15e6419ffaa449568fa0eb1cb</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>0449cb2b54bbb63584a501b2330aa76ab99c45298a9999b4f587e24e9df4262d</SHA-256>
              <SHA-1>b52b75f28961892905017b4ccc33dbc70301822a</SHA-1>
              <MD5>3e82c95c8f12e9f281d621684a9e4f16</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>0e6f5b626cecee3cd33f69189cdcedded9829cb22d47b5c147cdd5e7e7d9dbdb</SHA-256>
              <SHA-1>46375b8d2d2f47b96ff39206c92e10d689f8141b</SHA-1>
              <MD5>57448b7bfc01ec6b154a740b952adbaf</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>11fa0277921fd025ea3185bc9b471d83b8ab284482615ff55f5c2a2a16d4eac3</SHA-256>
              <SHA-1>e56080967b7ad881c85369a70ff994e8cbceff3a</SHA-1>
              <MD5>61566bc0f59c89879177278f37cf27ff</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>1b04aa29f23a895d8935f57dfc1d89ea30ef5a0bd1db6114ad576a0327b5f151</SHA-256>
              <SHA-1>50ba44b220d1f5610e2cdb1e3e3e02edc3aca63a</SHA-1>
              <MD5>9d8d9c3051f18e807a3d1b0ed9bbce96</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>1c96a03721fabf3dc1a95a039498e40ea09d24855bcf6a75b7983301d1ff987b</SHA-256>
              <SHA-1>5d9ca32e3a2fb92c8bad7796cdecaef44347159e</SHA-1>
              <MD5>2e8469aba04a905548ec50f15898a2cd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>39f832756a73a0ad2a4ce16d2fbf3e26b405ff189277b94d106215999bff9bc9</SHA-256>
              <SHA-1>40db7e840c8cffd0b0a7eb7a994720fe3e102879</SHA-1>
              <MD5>b02014b2a95043c2076aa8adc1a9721d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>512f04555b99dc6f72bba71994b84950d7f1b4638c5e57b56b2b5410770cb3d5</SHA-256>
              <SHA-1>af29f937e85ce37dd7a220b5387a139c39a566d9</SHA-1>
              <MD5>6a79fe85bb92ca0dfb46b6fcbb8f060d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>6aea85b34b57cf850fc0ba34d4a71a34f130e1f0f81dd899d04ee54ca9e8a109</SHA-256>
              <SHA-1>7dfca95ba94192186b1ea7806a319e2b82f5cf5c</SHA-1>
              <MD5>5c43494f73aed3c67d7b0efaa58a763f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>6e4e5351d78643d98b48af32025efea847e57f23996e289c20e2b071c3109396</SHA-256>
              <SHA-1>67c35de1724beb81ac6adcafab9a42188b0b3e5b</SHA-1>
              <MD5>bf6f9e1576df47183dd158b83e7d6186</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>822256ec08123c8f44fa6f9850f1304cc51e9b51f36b3620803ab3b311e930b1</SHA-256>
              <SHA-1>f15df161b2570d5df70c56cfc6e50483fe8773cb</SHA-1>
              <MD5>ebdb61065b77e4a04e425ab7a90ea73f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>83e1b9cc7dca10304a98b49ce9d42e8a84142cd87f11c41e166177e24dfb2e2d</SHA-256>
              <SHA-1>cc6f04618738d0d00f0b0a25369ac4536d4abd16</SHA-1>
              <MD5>48482346f425e5c53f1fb52ea176d193</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>896cd91fa171e6e0b1f6fea1c45cd03f2380500ef054302ce0fd2b60280f126f</SHA-256>
              <SHA-1>a554111bc007c9660cf7bd441191dc75f42471b1</SHA-1>
              <MD5>79a1a74f33124752094022cb937847f4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>96a43fbfedb114a84595f99c4d99a15e9c5f11e076ec8c83ef2be334e48da8df</SHA-256>
              <SHA-1>6d0b4d715f6c8de130a046302307cb94aaf26a80</SHA-1>
              <MD5>be587807111b39b0ff2570de1fb6cf14</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>cbd8675cde3154a59123656da799385eb31d016e10822c87e77424cc08b5e43e</SHA-256>
              <SHA-1>a0d4c31a0d4844d1487d4a9adc373eb477847f7d</SHA-1>
              <MD5>f4a0c82b4e7bb06a6ee72046043c16f7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>da68d1d09af318bb56f7da1ec12c1d171cb24598b219e6f12c5fee7fb69899e1</SHA-256>
              <SHA-1>6e4428c16aeb0e1249f50ec993084ba8ca1ae0b1</SHA-1>
              <MD5>8dd034d40384042a3543ef4dc421daef</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>e09285cd0cf543275185ad6f52149e65dab3ebc5d967a341b061ccb6c5650367</SHA-256>
              <SHA-1>8afe2547f99776516e1a82e3bdc6bdf93673829e</SHA-1>
              <MD5>1990f64367db7f267c8b8226b607d650</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>f95cbd7b91a85e0af7dd5beeeda3e890876a4e4b9ca5b3788a8091f2c4649ed5</SHA-256>
              <SHA-1>4449031cf3c5f99732fa60586ccbafc3cd139892</SHA-1>
              <MD5>217c55b5bb8397a22651a74835765195</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>ff7a81cbd2ddcc2eed59617fb749a53395290c0944d46934a9b85a5ea766ec47</SHA-256>
              <SHA-1>1b7ca63fbf3a820d79fefb132be30b5a45ea85a2</SHA-1>
              <MD5>5273fd03f7f0b305239e80943dd9cb64</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
          </files>
          <registry>
            <value>
              <registry>HKLM\SOFTWARE\Microsoft\Avalon.Graphics\DISPLAY1</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Themes\Personalize</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\Shell\Associations\UrlAssociations\mailto\UserChoice</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
          <btc_wallets>
            <value>
              <btc_wallet>x75fa5e:$btc: 333333339388777558577567c</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>UTHSB_MPtool_Lite.exe</name>
        <report_id>50d2af42-61d2-4c34-901c-937f4ea74748</report_id>
        <tags>
          <value>peexe</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>crypto</value>
          <value>evasive</value>
          <value>keylogger</value>
          <value>reconnaissance</value>
          <value>expand</value>
          <value>fingerprint</value>
          <value>lolbin</value>
          <value>packed</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e4786668898ad06b29bf5c7d6f65c68ccac0029647fe594fa35aae8aabf408d5</id>
    <title>Analysis Report for e4786668898ad06b29bf5c7d6f65c68ccac0029647fe594fa35aae8aabf408d5</title>
    <updated>2026-08-20T23:07:05Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8788fcf2677ae4d366dada</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6a878896f21817d7f908736e</flow_id>
        <hash>e4786668898ad06b29bf5c7d6f65c68ccac0029647fe594fa35aae8aabf408d5</hash>
        <iocs>
          <urls>
            <value>
              <url>http://www.binance.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.bitrefill.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.coinbase.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.crypto.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.etoro.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.binance.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.bitrefill.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.coinbase.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.crypto.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.etoro.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.binance.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.bitrefill.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.coinbase.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.crypto.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.etoro.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.binance.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.bitrefill.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.coinbase.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.crypto.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.etoro.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>file:///tmp/tmp067wqvfe.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.binance.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.bitrefill.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.coinbase.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.crypto.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.etoro.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>binance.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>bitrefill.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>coinbase.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crypto.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>etoro.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>binance.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>bitrefill.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>coinbase.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crypto.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>etoro.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.binance.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.bitrefill.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.coinbase.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.crypto.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.etoro.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>binance.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>bitrefill.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>coinbase.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crypto.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>etoro.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>binance.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>bitrefill.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>coinbase.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crypto.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>etoro.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>172.66.175.15</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.19.222.17</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>184.30.135.110</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.35.15</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>54.199.248.154</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>208.185.9.225</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>a453201a986dc0bbaa5889bdab0789ec8209ed48cd871049dd3bed652ceb14f7</SHA-256>
              <SHA-1>28d63920fe6157a359f7119e76ec2cfd9e0cb6b5</SHA-1>
              <MD5>75edfd1e0b700f79f014f40b2739df0e</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>169a1485616253b231d737b9617dc34c15066c9452824bec5e2c686e8d995d9f</SHA-256>
              <SHA-1>44a4daccf17fdd0dcfee9849fffc18d447c9e7bc</SHA-1>
              <MD5>2ee5fb14d4fe1d58cbd3b4938e301024</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>298031eda09fde2960f502933ef263cb3a6405de22784c180cddce0329ea37ef</SHA-256>
              <SHA-1>e0c6e9f1225c4d6b4cbb2ebc04518fdb8a940a0c</SHA-1>
              <MD5>6e9f3ee9ff2218360b3b02f814d26ddf</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>d4a3cd44ed29d6a342c58b0bed97fb757d6fa0dc1d0b8f607455ad204b82c1de</SHA-256>
              <SHA-1>a0180df1a1e50c6e6ca08f9546d96ebef94ef85c</SHA-1>
              <MD5>d0919eb38be17dfb50b3669ea5f59f0b</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>86e2ce8768857e1bf65ea5e57bec79e91c3b2819679c396d275e34552c3fd7bd</SHA-256>
              <SHA-1>cd8c465a26bf1c837f9ea748c4826ced8057ee6f</SHA-1>
              <MD5>b44b3c73cdd99a9a1348098b355db9f7</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>x87c:$btc: 1DFN2R8w1Qos6Cwi4kp68ACZLSHHFeaRF</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>submission.eml</name>
        <report_id>a2958f9b-334e-46b9-a796-218f2a996c12</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
          <value>html</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>7cacd6a0c31e69d4bc656a38f59f1375c5b33b4c0663095b5d7c3cf994cf037a</id>
    <title>Analysis Report for 7cacd6a0c31e69d4bc656a38f59f1375c5b33b4c0663095b5d7c3cf994cf037a</title>
    <updated>2026-08-20T23:06:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878891f2677ae4d366dac5</_id>
        <file_type>text/x-msdos-batch</file_type>
        <flow_id>6a878868befbfb13af7f13fc</flow_id>
        <hash>7cacd6a0c31e69d4bc656a38f59f1375c5b33b4c0663095b5d7c3cf994cf037a</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>6f79a2cc42abf82a87d588aeb447d87b436a2a77b0f87d83ae3bad659d2df203</SHA-256>
              <SHA-1>912b4a2200186a128448c7a72beb5046e2dc096c</SHA-1>
              <MD5>d7b339171103be86277e2f79d57dffd0</MD5>
              <origin>BATCH_SCRIPT_EMULATION</origin>
              <file_type>text/x-vbscript</file_type>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>x11d38:$btc: 1QGSn7SBur91dnkfo8CS59p8f6</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x14d46:$btc: 1kTGmGHzZRfVtWBQLua9cw3HKx</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x17252:$btc: 3g6A8aW2F7nHn79jaGfZv3cagthuJD1</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x18a52:$btc: 1DBurfZugkoiFJq7YubEu5JY5hvm6w</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x2c5ec:$btc: 3qURknjQ4gkppyw9hPRjdhFXJw</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x43fd4:$btc: 3yTFTbhinKSPQdzPTmLXTCP8Gh</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x551d3:$btc: 1BHMHaSLbqUEr8d68JdfK91Bu</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x5de4a:$btc: 36ytCuGyNvdEFzJunCbb2cg22JXhAyb</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x6702b:$btc: 3VVn3ogSdYUTyX9sAu2iN8PUNZG1GZ</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x6e01f:$btc: 1A4k7FW2C79YLnVnSoGYiaKBb</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>DocuSignSetup.bat</name>
        <report_id>a2aefe3a-c468-46ba-adf1-a6c627b75c0e</report_id>
        <tags>
          <value>bat</value>
          <value>anti-vm</value>
          <value>cmd</value>
          <value>lolbin</value>
          <value>evasive</value>
          <value>fingerprint</value>
          <value>mshta</value>
          <value>msiexec</value>
          <value>powershell</value>
          <value>taskkill</value>
          <value>wscript</value>
          <value>obfuscated</value>
          <value>zero-day</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>74f28d014a57cc0de2a27fc67f7267b33a48f8fafcace88215cf8f469d1e5009</id>
    <title>Analysis Report for 74f28d014a57cc0de2a27fc67f7267b33a48f8fafcace88215cf8f469d1e5009</title>
    <updated>2026-08-20T23:03:09Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8787fdf2677ae4d366daa4</_id>
        <file_type>text/plain</file_type>
        <flow_id>6a8787aab107fd4d6e9026f3</flow_id>
        <hash>74f28d014a57cc0de2a27fc67f7267b33a48f8fafcace88215cf8f469d1e5009</hash>
        <iocs>
          <urls>
            <value>
              <url>http://www.rlvision.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.rlvision.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>rlvision.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>rlvision.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>107.6.162.194</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>319a4f55942733b81e32be64a78a70e0a2c2126cd250eb870221ccad56897424</SHA-256>
              <SHA-1>c8db3e4f7936b48883d68358999e5cafdaf5dbd4</SHA-1>
              <MD5>e625a42c6d66901bbd256da7e91597c2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>ReadMe.txt</name>
        <report_id>9e17d906-92f0-4e7f-b823-f7179b419b7a</report_id>
        <tags>
          <value>txt</value>
          <value>html</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>18f22e7cae7c989aadedf61c0cbd4dbe39a8179dedeef64076533b3ab2ff2ad9</id>
    <title>Analysis Report for 18f22e7cae7c989aadedf61c0cbd4dbe39a8179dedeef64076533b3ab2ff2ad9</title>
    <updated>2026-08-20T23:03:09Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8787f1f2677ae4d366daa0</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6a8787aab107fd4d6e9026f3</flow_id>
        <hash>18f22e7cae7c989aadedf61c0cbd4dbe39a8179dedeef64076533b3ab2ff2ad9</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>fbb147942af92dcd35ac803fac2732c3b6308bd3f029f97615b40586b271b8bc</SHA-256>
              <SHA-1>2c5ec0216045135f9ae8280044b814836c215d6d</SHA-1>
              <MD5>802bab873861f8c526b1f112b0a9dab1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>Interop.Shell32.dll</name>
        <report_id>6352c0c3-c120-4320-ac50-17c07c479321</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>dotnet_pe</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>4ddd9bad51ed5b9404ac49e82226e3555e223e5655f911fdca137583f7f606a0</id>
    <title>Analysis Report for 4ddd9bad51ed5b9404ac49e82226e3555e223e5655f911fdca137583f7f606a0</title>
    <updated>2026-08-20T23:03:09Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878812f2677ae4d366daab</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6a8787aab107fd4d6e9026f3</flow_id>
        <hash>4ddd9bad51ed5b9404ac49e82226e3555e223e5655f911fdca137583f7f606a0</hash>
        <iocs>
          <urls>
            <value>
              <url>http://www.rlvision.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>rlvision.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>107.6.162.194</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>0fdd13018d459879bed1c37d1f070e61bca732b0ed681f3b54da56f161a45041</SHA-256>
              <SHA-1>ed22be0a2b0436758ec1489adfee8178bab2c4fa</SHA-1>
              <MD5>32b87ea8a7b6b5e3cd9c59d8a0886e80</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>140594ab19692a4e03d5f371111949611e92444fd024133f49a3892a1905f7cb</SHA-256>
              <SHA-1>6da109d25b533bbc2533c301bdce71f2a7a9cdaf</SHA-1>
              <MD5>f0fe75f18d301a457105339362da0a50</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>14ade070c53e6fd1769cc248452e3c50ba8e66f99661d0453b5fec112415f928</SHA-256>
              <SHA-1>6e419e921a041e2c097be122b59f641eba055b1f</SHA-1>
              <MD5>b672017c0c0ba3de65726f5b89275859</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>2b6008082ee55fdf192ba852c8f1ff9c4614eba40521111edd4035bad36f00bd</SHA-256>
              <SHA-1>93179a17de910dfae90c6ac68c59d3abb9eb4057</SHA-1>
              <MD5>c372fcd9ee09a23a1aa9c337178f165b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>3194d7c558a8f9460fec02a208d150146056638c8bae5cbd902df85b3cf3a2ff</SHA-256>
              <SHA-1>91afe27dc603576b5be3cc7d1481b88eb2e66c75</SHA-1>
              <MD5>ec491e0058760dd60ca996f1bcfba12f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>32683d18352d1fe79091e42f4a5cdc3cf0cacb923967a5d4cc411e9ccb16087d</SHA-256>
              <SHA-1>c222cee19fcaac245914095da682790dfd1d8f2f</SHA-1>
              <MD5>af5de3d9bc8a02ec28b8265ddb568324</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>64358ad19a8f8e457605f11c57c31a21e3b795800c6c774539879da442cfb4e5</SHA-256>
              <SHA-1>4113e686aa161ea5f218a9c08b8c05b2e6e98268</SHA-1>
              <MD5>8c64a03ff01c952ffb76528b9d821156</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>7057a994f9b02e54d8ee9788039855e44b05c32f0cce7145837bce8243fc250c</SHA-256>
              <SHA-1>88d73d9dbc22f15c47d5f4cba88a8872a21a8c63</SHA-1>
              <MD5>58c640f85e3087a9f410fab6680ca468</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>75d326cc4069c81faf61e5bea716971709974ed223f439f84b4300b35be1de6a</SHA-256>
              <SHA-1>723a3d21eb7d6d79144f55d1b318b2eb43b0b133</SHA-1>
              <MD5>3b04a333e1039304318480376470a308</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>8916a352c0177df1009ee8fa05c1f3455d64ae6f894a8ef7797d6d321f465415</SHA-256>
              <SHA-1>42754749b8b53956b7e21a28ecba5691db4fa5f1</SHA-1>
              <MD5>481782330a67f93c1ff9259e0b7a4528</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>89e1492f3104cc375860bd611387441c346245d56479e35cdad39bfef7886564</SHA-256>
              <SHA-1>d5a0c9ff10ce86460b0dc5055d41fb0335434089</SHA-1>
              <MD5>01a730fdfcf8cb826b82d2723de186a1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>a52a041de0730cae071912e569c8d8ba4c2ec2532b376c651ca5e7d814b90a17</SHA-256>
              <SHA-1>a121cf6029e8b78bce52e1646d441986cbb2508d</SHA-1>
              <MD5>96efdfe11228c7b29e4c7d5e6cb370cd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>c72065ee42a8001fbe59661ae65d6c4408e0c94dee1448f6cfdd5a4c568fb5ef</SHA-256>
              <SHA-1>6d70adba045da3044c35682758f98416179b5284</SHA-1>
              <MD5>18e905a5dbd73c8528f611291f27e7b9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>c85372ba60db29d9d79e855be28b4dffde4a3afb8d92cf5e992bc67059f30b47</SHA-256>
              <SHA-1>7bddadcc18611414c0e777e36b582f7feb7b3963</SHA-1>
              <MD5>bb093253d65f9a41db563746078e52ae</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>d210fa15a2e914d3667f8b5459eb6c07f8aae60fd0afb0c82efb1a3fa85c51da</SHA-256>
              <SHA-1>c7dbec0d6e15f07e7feeb058663febbd111b57ce</SHA-1>
              <MD5>45249918e5d31cc127beb4afd17e29d1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>e5a1e3b0e961602ca157fa93cb888a7aa8e7b2e3e5ebeddf703e9527b7fe04c1</SHA-256>
              <SHA-1>5a758cfd91da150f61c5c84b5a278563cf722660</SHA-1>
              <MD5>06d2ef168c5bf78ea0bf5b474d74b2a4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>ebaca63ef57ed64d047c67d23fa1129a0e8550cc5693d96d6e23729800ac2117</SHA-256>
              <SHA-1>639be039db94186a69b11042987f69f69ebbdc9e</SHA-1>
              <MD5>297301c8505645fcee4306a432cb3250</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>f22b5a5e1d3cf1fe53cf4d5de065a715f69c3f151f586f6f278e729d16ee0350</SHA-256>
              <SHA-1>4d8a1f442b9c8186123debed32cf9c57e125b3cd</SHA-1>
              <MD5>c1a233ba069d993fe34543e4e4eca81f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>c3c5c52144c62c9166fbaae17f591092fda28c6d0f622a64e68edee797eafbad</SHA-256>
              <SHA-1>028a08c9b7f6d26d395f2ae85efc979347d5f634</SHA-1>
              <MD5>172f0c0ca8a3ff7d5d22b128a5c0ae53</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>319a4f55942733b81e32be64a78a70e0a2c2126cd250eb870221ccad56897424</SHA-256>
              <SHA-1>c8db3e4f7936b48883d68358999e5cafdaf5dbd4</SHA-1>
              <MD5>e625a42c6d66901bbd256da7e91597c2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>ee7aa49c-9e5e-4f48-9100-5204e37b885f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>PhotoSift.exe</name>
        <report_id>16c4763b-7c0c-4b41-a678-f5549626ac73</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>dotnet_pe</value>
          <value>packed</value>
          <value>obfuscated</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903</id>
    <title>Analysis Report for 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903</title>
    <updated>2026-08-20T23:03:09Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878825f2677ae4d366dab1</_id>
        <file_type>text/plain</file_type>
        <flow_id>6a8787aab107fd4d6e9026f3</flow_id>
        <hash>8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903</hash>
        <iocs>
          <urls>
            <value>
              <url>http://fsf.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.gnu.org/licenses</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://fsf.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.gnu.org/licenses</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.gnu.org/philosophy/why-not-lgpl.html</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>fsf.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>gnu.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>fsf.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>gnu.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>209.51.188.116</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>209.51.188.174</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>3bb784557128f31a2072fc84695f06c05229d544d20cb64fa51ccbc991c839dc</SHA-256>
              <SHA-1>4306d9eca28ca618ea516661a7485481d61dae68</SHA-1>
              <MD5>829f58c59a2ab3a644efd99ddf44096f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>LICENSE.txt</name>
        <report_id>d2d182cc-4d1d-4478-a15c-3302586494e8</report_id>
        <tags>
          <value>txt</value>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ad7e0d4f72226c5741250658762a4b2f2688a9bea4288ba218ec80d7726630c6</id>
    <title>Analysis Report for ad7e0d4f72226c5741250658762a4b2f2688a9bea4288ba218ec80d7726630c6</title>
    <updated>2026-08-20T23:01:50Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8787bcf2677ae4d366da94</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a87875ebefbfb13af7f119c</flow_id>
        <hash>ad7e0d4f72226c5741250658762a4b2f2688a9bea4288ba218ec80d7726630c6</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schemas.microsoft.com/SMI/2005/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/SMI/2016/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>0088edf54a219c2da10262eedd161a96cfd4cc60a6a93d5651f0a8bec883bdee</SHA-256>
              <SHA-1>e1192a7c8e5dbe1ce608c0f2ad71edfbb71a33c1</SHA-1>
              <MD5>e149f2d7340513f382e75445f83ae550</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>13d1b1f997218ec54904c4f51f803919c57b5bd10f54ed33ff9320bb19ba10c4</SHA-256>
              <SHA-1>940127bc95d6d7a48321c69e09da322d8c76baa5</SHA-1>
              <MD5>9f3e6a6e92ed01ea006513f8ac8c7141</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>1c7d2050025c28aebacd237f7a7b10a8d1150d0ef59b0457afd07ec254113889</SHA-256>
              <SHA-1>c225814be5d3b9ea1c6005855906d3b8cd184614</SHA-1>
              <MD5>69533f559b8c39e89d263909b09df1a3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>2a87b1f32c5d0435090c72c392b75394f706e5750eff64fd85d25e1c622ee581</SHA-256>
              <SHA-1>52ca961fd37ad960905a681d1db5157508ef1602</SHA-1>
              <MD5>3bf2dac037ce87794e66ff7f054e913f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>37dca87305669d361c248888983f1134276ae35ab2ca5eb0b90b36638881b2d4</SHA-256>
              <SHA-1>2e6c7d88c520c4ec4bbb4eed8c38a1e0fe7df30d</SHA-1>
              <MD5>35628be976101059b7e72bef6654dba8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>3d709dcab266a758e0e166eb631dc0bcceb7157b2c7ac989b9099f9a5bcf7f63</SHA-256>
              <SHA-1>020a77c4d9900a09c5085defdcc8b7be55e667f6</SHA-1>
              <MD5>ee65bb375790eb3c496b076f57ba7f40</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>51e611bb08fed62d1e8de7dd2171671a08365bacf933c9e1edcde0e36ba7cd28</SHA-256>
              <SHA-1>191d18016ff2d4b180a278e1356eff61ce3772cb</SHA-1>
              <MD5>118d7349fddef48897dd97819864ea50</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>5d171b4c321bab3407622b774dc0650686ecec9f355541827612c1008e7bc2a2</SHA-256>
              <SHA-1>cbf289e07cc1d6fd2d3a57eb80090bf6c311ca78</SHA-1>
              <MD5>50483d7f901df3de449655f9966200c4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>5fdb88ffa207046f54acb4e1a0120500135b72fea89201c23de656736768e33a</SHA-256>
              <SHA-1>aea7e6c4d6e1e651f28e420c2659bdc761c32d52</SHA-1>
              <MD5>2a7a45edeb5fda9323b6e32b89a75e5d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>662bb2acefb558f63c6f2502dd6d78aa20a8c577168e4be450bd421e742ab19f</SHA-256>
              <SHA-1>e217399c3819d1135b1fdbfb91c2a9cd3b49c1d6</SHA-1>
              <MD5>6eebfbf55b7d3a48eb4652fa709a055a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>754f64ba82e393662720f0971a2b3b9cad9054de44e2fcba5b7ad8bb034d72f2</SHA-256>
              <SHA-1>11104b852dd6c0d421401c22db1c857fc6bcac06</SHA-1>
              <MD5>c60ebcc4894b58c6e48c0c85a68bb849</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>75a4b4b2a0836a41a414aa6c3e8678c9deee67d9e3d694a577315257759deef3</SHA-256>
              <SHA-1>47ba4597827b8573a1f383223154fb3e749a70f0</SHA-1>
              <MD5>e61e6a6c0f255f91f4713939759f007d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>7e4d6113da177f2683c12455ee482871099c5d682696fe863d72074f64bc701d</SHA-256>
              <SHA-1>c0850043e4475ed9045aa6ef263f9ac07c27d816</SHA-1>
              <MD5>a0292250ea52c11d2073ea2b7f829a20</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>7fc21942c9a1167274d9eb129fb807aed32f55d1ff13427fca42cabc119945d9</SHA-256>
              <SHA-1>62cb3561b5d89184c3d6781c4943d2d3740707a1</SHA-1>
              <MD5>65a1fe9837ce01d53a24febe163a3748</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>8dd805fb51fe100d54906342567cfca41314aeb362714bdf8f42929ff43dd8a0</SHA-256>
              <SHA-1>1a036fe01d0ed781a3891130210a5657b9bd7411</SHA-1>
              <MD5>c062d33e0bd3c67e94c498e77921f5f1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>de7c587db29432c74c49ff5d12f8edbe3d7efe3b495bd6108209024bd9bdebbb</SHA-256>
              <SHA-1>a1b38e2842d15a5e87a733b4eef7263620ca7915</SHA-1>
              <MD5>94be7ff3968e8311264acec4ccb5348f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>de832e47de35eb1f1580ab0b10f19cd351530242783e62281a45edf3a7ca93b9</SHA-256>
              <SHA-1>d6892dca9c130b6accae31ee23cdba643f977f64</SHA-1>
              <MD5>7a0329d70d2b9ca3cdd5ff6f685d5a1c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>f791ab9ea22a6a2e1e4f77a70a22099da39bd64e3a22db10cd26f2a4b57b24c5</SHA-256>
              <SHA-1>670f6070d5b351914d029f20fee435cde9a3daa8</SHA-1>
              <MD5>55632f8571b1d736b58dd7ef3ee51400</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>fd69e66ef925e4aa82de47a4270e743a89d9112d91a667fd5029b330b59c25a2</SHA-256>
              <SHA-1>3884f78de32d2d4cf2f5f9133a31c2a1c74053f9</SHA-1>
              <MD5>a7d543155f011cd84e73e91ee732290e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>Restory.exe</name>
        <report_id>0ce9e195-9aee-4add-bc9e-71d492becd1c</report_id>
        <tags>
          <value>peexe</value>
          <value>microsoft_visual_cc</value>
          <value>anti-debug</value>
          <value>anti-vm</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>dd58dfc584cf8e3e6c8782dbfd33a93a3828920c6254774888e3d820e9fd3e11</id>
    <title>Analysis Report for dd58dfc584cf8e3e6c8782dbfd33a93a3828920c6254774888e3d820e9fd3e11</title>
    <updated>2026-08-20T23:01:08Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878789f2677ae4d366da8a</_id>
        <file_type>text/html</file_type>
        <flow_id>6a878732f21817d7f908716d</flow_id>
        <hash>dd58dfc584cf8e3e6c8782dbfd33a93a3828920c6254774888e3d820e9fd3e11</hash>
        <iocs>
          <urls>
            <value>
              <url>https://babylonterms.live/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://babylonterms.live/?__cf_chl_rt_tk=c0KB7y0YTr7.eUz5WL5AziYu1KSM3LMWbOSowJoqY30-1787266934-1.0.1.1-8fBPCL655IYiIXWF.ECLJ3UMkYmWcI4170PYufSH1So</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://babylonterms.live/cdn-cgi/challenge-platform/h/g/fo/2612873987:1787263509:soX_88YbYc2CLYRjdmlAnX3XX0RQru3DfM-KcsTTxcI/a2e50644c95c927d/Oucxjsh0eAbBvorsGerngATBkQMl0TAxgfogjF2HCao-1787266934-1.2.1.1-vd492mfplYOF_xSjxTW5hwDBOZ.Foj9_zZT74LicDLF5dCw0G5kzwn9OREIgEMt8</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://babylonterms.live/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=a2e50644c95c927d</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://babylonterms.live/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/f/av0/rch/3mavf/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal?lang=auto</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://challenges.cloudflare.com/turnstile/v0/g/aae2b9a1c261/api.js?onload=mlyM5&amp;render=explicit</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/privacypolicy/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com?utm_source=challenge&amp;utm_campaign=m</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>1.0.1.1</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://babylonterms.live/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>babylonterms.live</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>challenges.cloudflare.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.cloudflare.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.18.95.41</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>188.114.96.3</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
          <btc_wallets>
            <value>
              <btc_wallet>xd1b:$btc: 3AHwuyQQGMr8paFyA9JKZCWW1G</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>hxxps://babylonterms.live/</name>
        <report_id>344dacc3-b20c-49e1-b82d-3642e45a391a</report_id>
        <tags>
          <value>html</value>
          <value>aidetect</value>
          <value>phishing</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9ed12b703075abb1a606787b870078c1bb9663a6807eee2df408eb2b24d259cc</id>
    <title>Analysis Report for 9ed12b703075abb1a606787b870078c1bb9663a6807eee2df408eb2b24d259cc</title>
    <updated>2026-08-20T23:00:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878740f2677ae4d366da72</_id>
        <file_type>application/octet-stream</file_type>
        <flow_id>6a8786fdb107fd4d6e902662</flow_id>
        <hash>9ed12b703075abb1a606787b870078c1bb9663a6807eee2df408eb2b24d259cc</hash>
        <iocs/>
        <name>RTL9210B_gd_v4.30.23.071922.bin</name>
        <report_id>e4184ae3-a2ec-4465-8ba6-3562e17df779</report_id>
        <tags>
          <value>data</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f551f8de7d96e6d06e3f99aff12571118e526e734c81fe460e5751aa29ae4708</id>
    <title>Analysis Report for f551f8de7d96e6d06e3f99aff12571118e526e734c81fe460e5751aa29ae4708</title>
    <updated>2026-08-20T23:00:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878741f2677ae4d366da74</_id>
        <file_type>text/x-ini</file_type>
        <flow_id>6a8786fdb107fd4d6e902662</flow_id>
        <hash>f551f8de7d96e6d06e3f99aff12571118e526e734c81fe460e5751aa29ae4708</hash>
        <iocs/>
        <name>UTHSB_MPtool_Lite.ini</name>
        <report_id>c7d8f4db-8ec1-4ba4-aa2f-23a4ad07db0f</report_id>
        <tags>
          <value>txt</value>
          <value>ini</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>88b150850a032cf39d957b81a31fd5fe1bf18a904c841bed2e35bbf25ba15276</id>
    <title>Analysis Report for 88b150850a032cf39d957b81a31fd5fe1bf18a904c841bed2e35bbf25ba15276</title>
    <updated>2026-08-20T23:00:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878743f2677ae4d366da76</_id>
        <file_type>image/bmp</file_type>
        <flow_id>6a8786fdb107fd4d6e902662</flow_id>
        <hash>88b150850a032cf39d957b81a31fd5fe1bf18a904c841bed2e35bbf25ba15276</hash>
        <iocs/>
        <name>Config.bmp</name>
        <report_id>a3070a31-70be-4455-b17d-5cb0d0138272</report_id>
        <tags>
          <value>bmp</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>87959eb499371c4232a6b210a0e0ccbdb2c86dec32002e79efdba17a53eb5b2a</id>
    <title>Analysis Report for 87959eb499371c4232a6b210a0e0ccbdb2c86dec32002e79efdba17a53eb5b2a</title>
    <updated>2026-08-20T23:00:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87875ef2677ae4d366da7d</_id>
        <file_type>text/plain</file_type>
        <flow_id>6a8786fdb107fd4d6e902662</flow_id>
        <hash>87959eb499371c4232a6b210a0e0ccbdb2c86dec32002e79efdba17a53eb5b2a</hash>
        <iocs/>
        <name>log.txt</name>
        <report_id>5e3207de-feae-4b96-bf40-8e34137f8377</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>df57c192b0f302be73542e6c0735d9984ea5dc97ed418362be8fe94fd0c0e03a</id>
    <title>Analysis Report for df57c192b0f302be73542e6c0735d9984ea5dc97ed418362be8fe94fd0c0e03a</title>
    <updated>2026-08-20T23:00:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878760f2677ae4d366da80</_id>
        <file_type>application/octet-stream</file_type>
        <flow_id>6a8786fdb107fd4d6e902662</flow_id>
        <hash>df57c192b0f302be73542e6c0735d9984ea5dc97ed418362be8fe94fd0c0e03a</hash>
        <iocs/>
        <name>RTL9210B_v1.35.6.040126.bin</name>
        <report_id>b2e06cda-f3ce-4f80-80cb-05a7079d2ded</report_id>
        <tags>
          <value>data</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>c9893c40acd61de4f8a9ee10637b907d2288b8e15e6419ffaa449568fa0eb1cb</id>
    <title>Analysis Report for c9893c40acd61de4f8a9ee10637b907d2288b8e15e6419ffaa449568fa0eb1cb</title>
    <updated>2026-08-20T23:00:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87876ef2677ae4d366da84</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a8786fdb107fd4d6e902662</flow_id>
        <hash>c9893c40acd61de4f8a9ee10637b907d2288b8e15e6419ffaa449568fa0eb1cb</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>0449cb2b54bbb63584a501b2330aa76ab99c45298a9999b4f587e24e9df4262d</SHA-256>
              <SHA-1>b52b75f28961892905017b4ccc33dbc70301822a</SHA-1>
              <MD5>3e82c95c8f12e9f281d621684a9e4f16</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>0e6f5b626cecee3cd33f69189cdcedded9829cb22d47b5c147cdd5e7e7d9dbdb</SHA-256>
              <SHA-1>46375b8d2d2f47b96ff39206c92e10d689f8141b</SHA-1>
              <MD5>57448b7bfc01ec6b154a740b952adbaf</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>11fa0277921fd025ea3185bc9b471d83b8ab284482615ff55f5c2a2a16d4eac3</SHA-256>
              <SHA-1>e56080967b7ad881c85369a70ff994e8cbceff3a</SHA-1>
              <MD5>61566bc0f59c89879177278f37cf27ff</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>1b04aa29f23a895d8935f57dfc1d89ea30ef5a0bd1db6114ad576a0327b5f151</SHA-256>
              <SHA-1>50ba44b220d1f5610e2cdb1e3e3e02edc3aca63a</SHA-1>
              <MD5>9d8d9c3051f18e807a3d1b0ed9bbce96</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>1c96a03721fabf3dc1a95a039498e40ea09d24855bcf6a75b7983301d1ff987b</SHA-256>
              <SHA-1>5d9ca32e3a2fb92c8bad7796cdecaef44347159e</SHA-1>
              <MD5>2e8469aba04a905548ec50f15898a2cd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>39f832756a73a0ad2a4ce16d2fbf3e26b405ff189277b94d106215999bff9bc9</SHA-256>
              <SHA-1>40db7e840c8cffd0b0a7eb7a994720fe3e102879</SHA-1>
              <MD5>b02014b2a95043c2076aa8adc1a9721d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>512f04555b99dc6f72bba71994b84950d7f1b4638c5e57b56b2b5410770cb3d5</SHA-256>
              <SHA-1>af29f937e85ce37dd7a220b5387a139c39a566d9</SHA-1>
              <MD5>6a79fe85bb92ca0dfb46b6fcbb8f060d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>6aea85b34b57cf850fc0ba34d4a71a34f130e1f0f81dd899d04ee54ca9e8a109</SHA-256>
              <SHA-1>7dfca95ba94192186b1ea7806a319e2b82f5cf5c</SHA-1>
              <MD5>5c43494f73aed3c67d7b0efaa58a763f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>6e4e5351d78643d98b48af32025efea847e57f23996e289c20e2b071c3109396</SHA-256>
              <SHA-1>67c35de1724beb81ac6adcafab9a42188b0b3e5b</SHA-1>
              <MD5>bf6f9e1576df47183dd158b83e7d6186</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>822256ec08123c8f44fa6f9850f1304cc51e9b51f36b3620803ab3b311e930b1</SHA-256>
              <SHA-1>f15df161b2570d5df70c56cfc6e50483fe8773cb</SHA-1>
              <MD5>ebdb61065b77e4a04e425ab7a90ea73f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>83e1b9cc7dca10304a98b49ce9d42e8a84142cd87f11c41e166177e24dfb2e2d</SHA-256>
              <SHA-1>cc6f04618738d0d00f0b0a25369ac4536d4abd16</SHA-1>
              <MD5>48482346f425e5c53f1fb52ea176d193</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>896cd91fa171e6e0b1f6fea1c45cd03f2380500ef054302ce0fd2b60280f126f</SHA-256>
              <SHA-1>a554111bc007c9660cf7bd441191dc75f42471b1</SHA-1>
              <MD5>79a1a74f33124752094022cb937847f4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>96a43fbfedb114a84595f99c4d99a15e9c5f11e076ec8c83ef2be334e48da8df</SHA-256>
              <SHA-1>6d0b4d715f6c8de130a046302307cb94aaf26a80</SHA-1>
              <MD5>be587807111b39b0ff2570de1fb6cf14</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>cbd8675cde3154a59123656da799385eb31d016e10822c87e77424cc08b5e43e</SHA-256>
              <SHA-1>a0d4c31a0d4844d1487d4a9adc373eb477847f7d</SHA-1>
              <MD5>f4a0c82b4e7bb06a6ee72046043c16f7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>da68d1d09af318bb56f7da1ec12c1d171cb24598b219e6f12c5fee7fb69899e1</SHA-256>
              <SHA-1>6e4428c16aeb0e1249f50ec993084ba8ca1ae0b1</SHA-1>
              <MD5>8dd034d40384042a3543ef4dc421daef</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>e09285cd0cf543275185ad6f52149e65dab3ebc5d967a341b061ccb6c5650367</SHA-256>
              <SHA-1>8afe2547f99776516e1a82e3bdc6bdf93673829e</SHA-1>
              <MD5>1990f64367db7f267c8b8226b607d650</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>f95cbd7b91a85e0af7dd5beeeda3e890876a4e4b9ca5b3788a8091f2c4649ed5</SHA-256>
              <SHA-1>4449031cf3c5f99732fa60586ccbafc3cd139892</SHA-1>
              <MD5>217c55b5bb8397a22651a74835765195</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>ff7a81cbd2ddcc2eed59617fb749a53395290c0944d46934a9b85a5ea766ec47</SHA-256>
              <SHA-1>1b7ca63fbf3a820d79fefb132be30b5a45ea85a2</SHA-1>
              <MD5>5273fd03f7f0b305239e80943dd9cb64</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
          </files>
          <registry>
            <value>
              <registry>HKLM\SOFTWARE\Microsoft\Avalon.Graphics\DISPLAY1</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Themes\Personalize</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\Shell\Associations\UrlAssociations\mailto\UserChoice</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
          <btc_wallets>
            <value>
              <btc_wallet>x75fa5e:$btc: 333333339388777558577567c</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>UTHSB_MPtool_Lite.exe</name>
        <report_id>c5a27770-5d1b-49ad-894c-50d17ecf8257</report_id>
        <tags>
          <value>peexe</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>crypto</value>
          <value>evasive</value>
          <value>keylogger</value>
          <value>reconnaissance</value>
          <value>expand</value>
          <value>fingerprint</value>
          <value>lolbin</value>
          <value>packed</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0ae97d44b43c2b5705601a39154351fb853980bdb04a19e8f54cc29deda2f5fa</id>
    <title>Analysis Report for 0ae97d44b43c2b5705601a39154351fb853980bdb04a19e8f54cc29deda2f5fa</title>
    <updated>2026-08-20T23:00:14Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878715f2677ae4d366da68</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6a8786fb1d88974f46c40e44</flow_id>
        <hash>0ae97d44b43c2b5705601a39154351fb853980bdb04a19e8f54cc29deda2f5fa</hash>
        <iocs>
          <urls>
            <value>
              <url>https://aka.ms/LearnAboutSenderIdentification</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://www.opswat.com/solutions/email-security.</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://aka.ms/LearnAboutSenderIdentification</url>
              <origin>EMAIL_BODY</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://www.opswat.com/solutions/email-security.</url>
              <origin>EMAIL_BODY</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://aka.ms/LearnAboutSenderIdentification</url>
              <origin>INPUT_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://server.traincocious.com/index.php/campaigns/ys4806pbom837/report-abuse/zb8480eaay8db/or2634r0gabc1</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://server.traincocious.com/index.php/lists/block-address</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://server.traincocious.com/index.php/lists/zb8480eaay8db/unsubscribe/or2634r0gabc1/ys4806pbom837?source=email-client-unsubscribe-button</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://aka.ms/LearnAboutSenderIdentification</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://www.opswat.com/solutions/email-security.</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://aka.ms/LearnAboutSenderIdentification</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>file:///tmp/tmp9bw2qm5u.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aka.ms/LearnAboutSenderIdentification</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://nam04.safelinks.protection.outlook.com/?url=</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://server.traincocious.com/index.php/lists/zb8480eaay8db/unsubscribe/or2634r0gabc1/ys4806pbom837?source=email-client-unsubscribe-button</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:claudia.r%40traincocious.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:claudia.r@traincocious.com?subject=Campaign-Uid%3Ays4806pbom837%20%2F%20Subscriber-Uid%3Aor2634r0gabc1%20-%20Unsubscribe%20request&amp;body=Please%20unsubscribe%20me%21</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:eric.spindel%40opswat.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>aka.ms</url>
              <origin>EMAIL_BODY</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>opswat.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>aka.ms</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>opswat.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>aka.ms</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>nam04.safelinks.protection.outlook.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>server.traincocious.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>aka.ms</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>opswat.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>aka.ms</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>aka.ms</url>
              <origin>INPUT_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>server.traincocious.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>claudia.r@traincocious.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>992e9955ccee74d57acc31909f4b7bee951a7893@traincocious.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>bounce@traincocious.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>claudia.r@traincocious.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>eric.spindel@opswat.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>claudia.r@traincocious.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>claudia.r@traincocious.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>54.230.172.54</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>10.1.24.53</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>10.167.17.201</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>10.167.241.135</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>217.15.166.230</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>54.69.214.246</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>217.15.166.230</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>2.23.246.9</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>68cb2564b6bf8763d1a6bb86fc3718b748d2a34d990c88c1924255a279cc5a9e</SHA-256>
              <SHA-1>95a1a35d3248ba0097cccd285c467e619c1d5547</SHA-1>
              <MD5>5450dac8092f9dd882664d08550a2aae</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>ae27b12eed19958036b6d0e8532ebb5bfcf209f975857eee487e1c039379c102</SHA-256>
              <SHA-1>520766f8eae853cf73df00734ba9a3dcbca6d2be</SHA-1>
              <MD5>c8a2c79f6bc4ad07e49722a0ae9c8640</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>fce8b6a8510f7a5bf3dba8a4523fedf9fdd61c0d13fbce972c622f5b31a0b697</SHA-256>
              <SHA-1>22d7c4a5890a7e17606ced71276184fef7fba87a</SHA-1>
              <MD5>c9fb70c5bcd9c97eb7f41392cd66df0d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>959cd4c2a3d3c6129770145fff9af2a849daa1356fea6f2567f534fd34386e4d</SHA-256>
              <SHA-1>9e51c2de9d56ed5388c698af57696205e637023d</SHA-1>
              <MD5>d0a6b819aaf40e750c2dd9635c82bdb5</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>11d34487c1e35fc3995168f79589d6518407931fd906fd2168818d165a4e89ee</SHA-256>
              <SHA-1>915d760776c13ae1cd98af967cd14fb50d0d19ec</SHA-1>
              <MD5>e66cfbb1402a35f6ec8617e97e7e91d0</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>755f90ae3f480c5909948b04184f1a0e8ace251ab33c20d13b74527ae4484fbe</SHA-256>
              <SHA-1>68457dd018c9be851502825b2b63c0fe5c32341f</SHA-1>
              <MD5>db227e38f5814775f9db72acda9d8f03</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>58122277-edf8-4048-96c4-ec80d30669b8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>9084f8a1-cf80-4077-9003-08deff085a53</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>a9028e78-dda1-4fe1-8c3c-08deff087898</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <btc_wallets>
            <value>
              <btc_wallet>x3135:$btc: 3Vdq38KkEnnqj7hmcKV7zPf3R</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>Guidance for FM Managers From Operational Control to Strategic Asset Leadership.eml</name>
        <report_id>0160dea0-c66a-4936-9ab4-3991868be03e</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
          <value>html</value>
          <value>xml</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>223fe8564b60636bc738b6178d3ba9a50ef7d791266b0efae6363bb716e4c47f</id>
    <title>Analysis Report for 223fe8564b60636bc738b6178d3ba9a50ef7d791266b0efae6363bb716e4c47f</title>
    <updated>2026-08-20T22:59:08Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8786f5f2677ae4d366da61</_id>
        <file_type>application/x-sharedlib</file_type>
        <flow_id>6a8786b9f21817d7f9087079</flow_id>
        <hash>223fe8564b60636bc738b6178d3ba9a50ef7d791266b0efae6363bb716e4c47f</hash>
        <iocs>
          <urls>
            <value>
              <url>http://gnu.org/licenses/gpl.html</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.gnu.org/gethelp</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.gnu.org/software/bash</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>gnu.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>bash-maintainers@gnu.org</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>209.51.188.116</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
        </iocs>
        <name>1.bash</name>
        <report_id>b3f4f597-d81a-4ade-b584-d653cda416fc</report_id>
        <tags>
          <value>elf</value>
          <value>elf-shared</value>
          <value>bash</value>
          <value>expand</value>
          <value>lolbin</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ef7fe8c96ca7ebcb3d193ed2ceeb49ad109ba937542699a45537eb5acbf9857c</id>
    <title>Analysis Report for ef7fe8c96ca7ebcb3d193ed2ceeb49ad109ba937542699a45537eb5acbf9857c</title>
    <updated>2026-08-20T22:51:29Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8784fef2677ae4d366da08</_id>
        <file_type>application/x-msdownload; format=pe</file_type>
        <flow_id>6a8784efbefbfb13af7f0a3c</flow_id>
        <hash>ef7fe8c96ca7ebcb3d193ed2ceeb49ad109ba937542699a45537eb5acbf9857c</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>c93f6b524d2f003e1537a54c6daf0a5f4ea4badd2a2f2c8b254153abc1d7dcaf</SHA-256>
              <SHA-1>2c5ccc6a500822b9919f0133bad441828429ba69</SHA-1>
              <MD5>a9ccc6ff0c2cc70cac897de3764a5336</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/x-msdownload; format=pe</file_type>
            </value>
          </files>
        </iocs>
        <name>shell.exe</name>
        <report_id>61048308-a44d-4ebf-af61-f4163f8d44d3</report_id>
        <tags>
          <value>peexe</value>
          <value>cobaltstrike</value>
          <value>packed</value>
          <value>loader</value>
          <value>microsoft_visual_cc</value>
          <value>predictive-alin</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>6ac161405e42b0dad959ae3b0c08885d3018d70f5b34fc2fad630d9b7e49d6f9</id>
    <title>Analysis Report for 6ac161405e42b0dad959ae3b0c08885d3018d70f5b34fc2fad630d9b7e49d6f9</title>
    <updated>2026-08-20T22:47:55Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87844cf2677ae4d366d9e7</_id>
        <file_type>application/x-msdownload; format=pe64</file_type>
        <flow_id>6a878419b107fd4d6e90233b</flow_id>
        <hash>6ac161405e42b0dad959ae3b0c08885d3018d70f5b34fc2fad630d9b7e49d6f9</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>24099968e6750fa012485ab8c7f22f80bf8e133a099893a7726a22c26603b2e8</SHA-256>
              <SHA-1>3a5113cc5d0b814aa115257ca3d6d27d79e14c99</SHA-1>
              <MD5>f32fb1b6f8f612b61886d4cdf8a17069</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>3ac8f7519752b957391eb7fd849f189c98d4776f6db5dba2ff695c318bb8d250</SHA-256>
              <SHA-1>c4f87a24d3cc5f04ce7eba36c3288c7c236600a1</SHA-1>
              <MD5>99b78a6d60ad5bbba00abcda7c828118</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>6a78c0622687eae085945f24b3ab132e0e995d1d3329dbb04f0d8e1273ebf6fb</SHA-256>
              <SHA-1>3831bec2d44e864199e7b1be449e7313c55962f6</SHA-1>
              <MD5>548bd941e093c889a5ae7a3b3ace6ba4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>787ce1663a0821002a8f81762980a631b18508d4670990ea93b285f043b05bf9</SHA-256>
              <SHA-1>7ddeb1b7ef8fcd592927c672c62b392cf80d7458</SHA-1>
              <MD5>5c111e6f982848c2f9a63d17b816bb05</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>8241bdc2a181b30df7923f8a971ed1d8651aba3a7f92b2c0e1175879e5c7e454</SHA-256>
              <SHA-1>efd744e2ad7b8f1fb71d2ca865496b60d5774bd5</SHA-1>
              <MD5>fc86e3262da3c43f6464c6222fb6a0b3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>a7370b9224d35ecaba7006c72fd69d91383dd614efb531f3731088eadfba5847</SHA-256>
              <SHA-1>11912ad210fbd633d8533cfd8cb32972a454435c</SHA-1>
              <MD5>d6aef017df81b91cf894f5ad249ae636</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>c06f5bd42b0d87761f00dee7ff69b23c11afc469e093865c8e81db4e195c2ca5</SHA-256>
              <SHA-1>2e5d6f6eb75a89e5faa1a81b75962450e4d1c286</SHA-1>
              <MD5>7df91faa4045eb7842aded81610d3743</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>f46ba9047501d14c9eea66cf85fa710fcee518ddbfa2f5cd727310e0ddf2a9a9</SHA-256>
              <SHA-1>f9aa8c037558bf04442d5b9333fd53fd0f6c9ef1</SHA-1>
              <MD5>f79abe4dc01dd0d6064b6211957e0f45</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
          </files>
          <registry>
            <value>
              <registry>SOFTWARE\Microsoft\Windows NT\CurrentVersion</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Delphi\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\CodeGear\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>FLEngine_x64.dll</name>
        <report_id>ffd0e006-27ae-4f85-8460-6631f4969afc</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>similar-threat</value>
          <value>anti-vm</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>keylogger</value>
          <value>packed</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>embarcadero_delphi</value>
          <value>signed</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>7d1a459228ef71aeed78ee8bc8af008ec4cf01bb2fa456ed00c1158a695cdfc1</id>
    <title>Analysis Report for 7d1a459228ef71aeed78ee8bc8af008ec4cf01bb2fa456ed00c1158a695cdfc1</title>
    <updated>2026-08-20T22:45:54Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8783b0f2677ae4d366d9ca</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a87839fbefbfb13af7f0639</flow_id>
        <hash>7d1a459228ef71aeed78ee8bc8af008ec4cf01bb2fa456ed00c1158a695cdfc1</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schemas.microsoft.com/SMI/2020/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>1.18.5.11</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>127.0.0.1</ip>
              <origin>INPUT_FILE</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>72ae19a66b5d012088d762d3e2de6498a9b3b8fc153352ca6c76cf045d1fe96e</SHA-256>
              <SHA-1>df759518191bad6608c336186b31c120b3dadb34</SHA-1>
              <MD5>f7e7c81035fc42015d50fadd75b9300f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>294E088E-E3EF-42A9-AE0C-1EF642412F95</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>587203BC-5798-47BA-8BDA-C63D7DE25FCD</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>933823D3-C77B-4BAE-89D7-A92B567236BC</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>loader.exe</name>
        <report_id>afe7f2c7-d907-4e1a-b868-5b4cd863cd25</report_id>
        <tags>
          <value>peexe</value>
          <value>anti-debug</value>
          <value>cmd</value>
          <value>hacktool</value>
          <value>lolbin</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>evasive</value>
          <value>microsoft_visual_cc</value>
          <value>base64</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>3150bf5282941006307c505153079c2b61afe92d02f9abf287e97ec1c743d4e1</id>
    <title>Analysis Report for 3150bf5282941006307c505153079c2b61afe92d02f9abf287e97ec1c743d4e1</title>
    <updated>2026-08-20T22:43:05Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87830bf2677ae4d366d9ac</_id>
        <file_type>text/x-msdos-batch</file_type>
        <flow_id>6a8782f8befbfb13af7f044a</flow_id>
        <hash>3150bf5282941006307c505153079c2b61afe92d02f9abf287e97ec1c743d4e1</hash>
        <iocs/>
        <name>patch_summer2.cmd</name>
        <report_id>f0dc3e7b-4b49-4849-87d8-01daf46887ac</report_id>
        <tags>
          <value>bat</value>
          <value>powershell</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>fe4bbe30d04c5c610b2cbcb830adfe6e7cc0d43e784df688b3fc06cd087fe1bb</id>
    <title>Analysis Report for fe4bbe30d04c5c610b2cbcb830adfe6e7cc0d43e784df688b3fc06cd087fe1bb</title>
    <updated>2026-08-20T22:36:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878196f2677ae4d366d94c</_id>
        <file_type>application/x-ms-installer</file_type>
        <flow_id>6a878170f21817d7f908668f</flow_id>
        <hash>fe4bbe30d04c5c610b2cbcb830adfe6e7cc0d43e784df688b3fc06cd087fe1bb</hash>
        <iocs>
          <urls>
            <value>
              <url>http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedRootG4.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.digicert.com/CPS0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://go.microsoft.com/fwlink/p/?LinkId=2124703</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://wixtoolset.org/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cacerts.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl3.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl4.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>go.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>wixtoolset.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>23.11.40.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.67.139.212</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>88.221.169.205</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>45.60.131.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>15f7fc891b0be7649b8478a66c5076175481e2a38dedc5734b8f3b86c78c2237</SHA-256>
              <SHA-1>75c140d15730c5b4f1c37b5ef30c63ce064f9f21</SHA-1>
              <MD5>8fdfc035e9142300340f639481399abd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>4415a801858ba1b35a596816aefa5d88336255a2dda1380e7052a0765a47e2b2</SHA-256>
              <SHA-1>58a13fcc8d2906f29423c1d641f2a3b1757af295</SHA-1>
              <MD5>7b89df5cdcbcedaa020ef8956bf743ff</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df</SHA-256>
              <SHA-1>4260284ce14278c397aaf6f389c1609b0ab0ce51</SHA-1>
              <MD5>1e4a89b11eae0fcf8bb5fdd5ec3b6f61</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>4c6b49086eaf6bcc4337b7bced82ac1380cadad4156e1b90b2c7401a7f9f94e1</SHA-256>
              <SHA-1>9e2356e513111c953d0c2f0540b8bf079de8e79b</SHA-1>
              <MD5>84b4bcc452e2eb6bccd6791d302b7992</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>5337e8953a0f68a88b9491f6f9147ad6c1d3a532b28d1d55755dbb9486b3867a</SHA-256>
              <SHA-1>87710ae7898fd69892e28dc8b83f59a877ef1070</SHA-1>
              <MD5>4f44051fc9f3fbe402d5fb10291a94e2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc</SHA-256>
              <SHA-1>d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57</SHA-1>
              <MD5>cfbb8568bd3711a97e6124c56fcfa8d9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>8e25ceef6099764791a010adb84eea74ddf7c440c14eb7be6507a2dbd55be289</SHA-256>
              <SHA-1>274f6b1e34d1da4e639130816e3f0b07a33061e5</SHA-1>
              <MD5>337ba75c33de530112e14dcaf45e2ebe</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>a961ff27aa61c4a304927907e62949be2eab60003da2d5b85f3a3778e0a0f1f4</SHA-256>
              <SHA-1>6a06bed27445255703631bc80c325fa6be0801b3</SHA-1>
              <MD5>38b25d0f2277ea00fe0f66a4a486a494</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>b1cb832f790c153aa0e9a66f76e75460263cf1d41971d2dbcc9a4d87ec18b7d8</SHA-256>
              <SHA-1>2a4224d31c916a5cff4f2636a3cb47fdd84a5cc9</SHA-1>
              <MD5>01e4c8c046a47771f13cd120b53303e7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>b86b1fd03c5922ae01312cf5de26f60573b52a6e905db3e03e2b00bafe2da8d8</SHA-256>
              <SHA-1>9d6cd0bf7e27204515ad322b151ab03729f14e23</SHA-1>
              <MD5>44cc4a2486731238a5499bcfc85a748a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c84b9eeec992830649e11f5a7743a992ac28913b7eb0d2c3bb907c9c8cadfcc8</SHA-256>
              <SHA-1>ab2e69e3564ab6ced51c95a3f46fa0682cb48130</SHA-1>
              <MD5>1973b28fbc90c8facf5ce99cb2a83380</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>c998957562045d593156fefc2d83103ad945f2db3abffa2a5e18cb021539b977</SHA-256>
              <SHA-1>9753412e5cb4f7dc056b6e6301f68a1e9d394dd5</SHA-1>
              <MD5>c058d02cae8163400bb623ace9b4a6c8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>fda3a5a51bcbb3e4e42d37383e8622d8bdaf001e9ebaf4be1bd348891de6f05e</SHA-256>
              <SHA-1>171accc0c0b6f9a4bf4a14844d29da0bf149d35a</SHA-1>
              <MD5>36025b78784d2f8673d0d6b271a5ce3f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>023452F3-CF51-4E08-A8FA-4E55D11FC5D9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>03D1E657-281B-4D12-A36D-843FA6C18D6A</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>063716B0-C803-5A4A-83CD-225F9585FA08</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>0CF4AB04-9AC7-5EF7-8795-AF8513F64A82</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>25FD1782-67B0-4F5E-A445-F75C66F55AB1</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>2CB1B204-3BE9-471F-8E9E-069E0726BEBD</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4E4FD8C8-FCF6-5C17-8944-10871A85E2D8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>56ECB5EC-B476-4732-BFE7-EED1FCC6862B</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>676DCF54-0377-46D1-B764-34D0E01A8357</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>7D9245D6-89E8-5336-BE66-724CD8A234F0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8A7E4BAA-F14C-49F7-9BAB-BF3A672907C0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>98C55342-5871-536C-93E7-B19875DCA187</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>B7EF42AC-D313-4AD4-ACB6-8611D67E58DE</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>F1D36E5E-C142-575F-BD88-D9CFE0217A47</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>F3017226-FE2A-4295-8BDF-00C3A9A7E4C5</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\Policies\Microsoft\Windows\Installer</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>Cloud.v2.6.6.msi</name>
        <report_id>ab86ba18-8895-43f1-bfa1-41c83408b3e8</report_id>
        <tags>
          <value>msi</value>
          <value>keylogger</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>installer</value>
          <value>expired-cert</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e313c09240d94d6f8aed6e6f4c802f1dce4e204cb7020e72d5344a8cd93b3b26</id>
    <title>Analysis Report for e313c09240d94d6f8aed6e6f4c802f1dce4e204cb7020e72d5344a8cd93b3b26</title>
    <updated>2026-08-20T22:36:18Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87817af2677ae4d366d942</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a87815feeadd95beca17f90</flow_id>
        <hash>e313c09240d94d6f8aed6e6f4c802f1dce4e204cb7020e72d5344a8cd93b3b26</hash>
        <iocs>
          <urls>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/SMI/2005/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/SMI/2016/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/windows/2004/02/mit/task</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/Docs/Repository.htm0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/windows0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>crl.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>23.55.110.193</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>2.1.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>28f79651b756687c517665a160868fdb2e48b45a72dd5d6608fd7f552e9418b8</SHA-256>
              <SHA-1>a2a7fbe17de3cad8400ab7761f20ffd6daf955f5</SHA-1>
              <MD5>a7bf0688aae5aae22d16cfbbf204461f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>6e8acd0cc41ac2fc89815dce9bcee32941595e972c256e69c49606c2d5faa644</SHA-256>
              <SHA-1>3235fc627c8aaba74720abf407df2d2ec840db11</SHA-1>
              <MD5>acaf21a7ff7b11fda249008e06504dbe</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>7eb7f8ae29da5e85c41d3e55a446fed7746050f3913d07cf0d2410cd76468b12</SHA-256>
              <SHA-1>15f60f9a2ccecba960d4d254f88a67a0a50a0b47</SHA-1>
              <MD5>3530068f2e863c92f8280b46952648cb</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>e313c09240d94d6f8aed6e6f4c802f1dce4e204cb7020e72d5344a8cd93b3b26.exe</name>
        <report_id>aa29d151-6c4c-4abe-8ef6-d10e230fec1a</report_id>
        <tags>
          <value>peexe</value>
          <value>anti-debug</value>
          <value>dllhost</value>
          <value>lolbin</value>
          <value>packed</value>
          <value>expired-cert</value>
          <value>fingerprint</value>
          <value>obfuscated</value>
          <value>invalid-signature</value>
          <value>signed</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>fe4bbe30d04c5c610b2cbcb830adfe6e7cc0d43e784df688b3fc06cd087fe1bb</id>
    <title>Analysis Report for fe4bbe30d04c5c610b2cbcb830adfe6e7cc0d43e784df688b3fc06cd087fe1bb</title>
    <updated>2026-08-20T22:35:29Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878166f2677ae4d366d93b</_id>
        <file_type>application/x-ms-installer</file_type>
        <flow_id>6a878130b107fd4d6e901fc0</flow_id>
        <hash>fe4bbe30d04c5c610b2cbcb830adfe6e7cc0d43e784df688b3fc06cd087fe1bb</hash>
        <iocs>
          <urls>
            <value>
              <url>http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedRootG4.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.digicert.com/CPS0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://go.microsoft.com/fwlink/p/?LinkId=2124703</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://wixtoolset.org/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cacerts.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl3.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl4.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>go.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>wixtoolset.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>72.246.29.230</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>45.60.131.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>162.159.142.9</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.67.139.212</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.11.40.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>15f7fc891b0be7649b8478a66c5076175481e2a38dedc5734b8f3b86c78c2237</SHA-256>
              <SHA-1>75c140d15730c5b4f1c37b5ef30c63ce064f9f21</SHA-1>
              <MD5>8fdfc035e9142300340f639481399abd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>4415a801858ba1b35a596816aefa5d88336255a2dda1380e7052a0765a47e2b2</SHA-256>
              <SHA-1>58a13fcc8d2906f29423c1d641f2a3b1757af295</SHA-1>
              <MD5>7b89df5cdcbcedaa020ef8956bf743ff</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df</SHA-256>
              <SHA-1>4260284ce14278c397aaf6f389c1609b0ab0ce51</SHA-1>
              <MD5>1e4a89b11eae0fcf8bb5fdd5ec3b6f61</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>4c6b49086eaf6bcc4337b7bced82ac1380cadad4156e1b90b2c7401a7f9f94e1</SHA-256>
              <SHA-1>9e2356e513111c953d0c2f0540b8bf079de8e79b</SHA-1>
              <MD5>84b4bcc452e2eb6bccd6791d302b7992</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>5337e8953a0f68a88b9491f6f9147ad6c1d3a532b28d1d55755dbb9486b3867a</SHA-256>
              <SHA-1>87710ae7898fd69892e28dc8b83f59a877ef1070</SHA-1>
              <MD5>4f44051fc9f3fbe402d5fb10291a94e2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc</SHA-256>
              <SHA-1>d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57</SHA-1>
              <MD5>cfbb8568bd3711a97e6124c56fcfa8d9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>8e25ceef6099764791a010adb84eea74ddf7c440c14eb7be6507a2dbd55be289</SHA-256>
              <SHA-1>274f6b1e34d1da4e639130816e3f0b07a33061e5</SHA-1>
              <MD5>337ba75c33de530112e14dcaf45e2ebe</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>a961ff27aa61c4a304927907e62949be2eab60003da2d5b85f3a3778e0a0f1f4</SHA-256>
              <SHA-1>6a06bed27445255703631bc80c325fa6be0801b3</SHA-1>
              <MD5>38b25d0f2277ea00fe0f66a4a486a494</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>b1cb832f790c153aa0e9a66f76e75460263cf1d41971d2dbcc9a4d87ec18b7d8</SHA-256>
              <SHA-1>2a4224d31c916a5cff4f2636a3cb47fdd84a5cc9</SHA-1>
              <MD5>01e4c8c046a47771f13cd120b53303e7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>b86b1fd03c5922ae01312cf5de26f60573b52a6e905db3e03e2b00bafe2da8d8</SHA-256>
              <SHA-1>9d6cd0bf7e27204515ad322b151ab03729f14e23</SHA-1>
              <MD5>44cc4a2486731238a5499bcfc85a748a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c84b9eeec992830649e11f5a7743a992ac28913b7eb0d2c3bb907c9c8cadfcc8</SHA-256>
              <SHA-1>ab2e69e3564ab6ced51c95a3f46fa0682cb48130</SHA-1>
              <MD5>1973b28fbc90c8facf5ce99cb2a83380</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>c998957562045d593156fefc2d83103ad945f2db3abffa2a5e18cb021539b977</SHA-256>
              <SHA-1>9753412e5cb4f7dc056b6e6301f68a1e9d394dd5</SHA-1>
              <MD5>c058d02cae8163400bb623ace9b4a6c8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>fda3a5a51bcbb3e4e42d37383e8622d8bdaf001e9ebaf4be1bd348891de6f05e</SHA-256>
              <SHA-1>171accc0c0b6f9a4bf4a14844d29da0bf149d35a</SHA-1>
              <MD5>36025b78784d2f8673d0d6b271a5ce3f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>023452F3-CF51-4E08-A8FA-4E55D11FC5D9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>03D1E657-281B-4D12-A36D-843FA6C18D6A</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>063716B0-C803-5A4A-83CD-225F9585FA08</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>0CF4AB04-9AC7-5EF7-8795-AF8513F64A82</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>25FD1782-67B0-4F5E-A445-F75C66F55AB1</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>2CB1B204-3BE9-471F-8E9E-069E0726BEBD</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4E4FD8C8-FCF6-5C17-8944-10871A85E2D8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>56ECB5EC-B476-4732-BFE7-EED1FCC6862B</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>676DCF54-0377-46D1-B764-34D0E01A8357</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>7D9245D6-89E8-5336-BE66-724CD8A234F0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8A7E4BAA-F14C-49F7-9BAB-BF3A672907C0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>98C55342-5871-536C-93E7-B19875DCA187</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>B7EF42AC-D313-4AD4-ACB6-8611D67E58DE</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>F1D36E5E-C142-575F-BD88-D9CFE0217A47</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>F3017226-FE2A-4295-8BDF-00C3A9A7E4C5</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\Policies\Microsoft\Windows\Installer</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>Cloud.v2.6.6.msi</name>
        <report_id>b39f3d9c-b166-4aad-ad75-d42263af293e</report_id>
        <tags>
          <value>msi</value>
          <value>keylogger</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>installer</value>
          <value>expired-cert</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>251ecddd4672c9cf467547e3dc535de00ad2129df26e7e7ae728fa4e5ac45fc5</id>
    <title>Analysis Report for 251ecddd4672c9cf467547e3dc535de00ad2129df26e7e7ae728fa4e5ac45fc5</title>
    <updated>2026-08-20T22:35:02Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878122f2677ae4d366d928</_id>
        <file_type>text/javascript</file_type>
        <flow_id>6a878115befbfb13af7efe77</flow_id>
        <hash>251ecddd4672c9cf467547e3dc535de00ad2129df26e7e7ae728fa4e5ac45fc5</hash>
        <iocs/>
        <name>postcss.config.js</name>
        <report_id>f787020c-1ce4-4446-82a8-9facb7df1468</report_id>
        <tags>
          <value>javascript</value>
          <value>repaired</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>fe4bbe30d04c5c610b2cbcb830adfe6e7cc0d43e784df688b3fc06cd087fe1bb</id>
    <title>Analysis Report for fe4bbe30d04c5c610b2cbcb830adfe6e7cc0d43e784df688b3fc06cd087fe1bb</title>
    <updated>2026-08-20T22:33:38Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8780fdf2677ae4d366d91d</_id>
        <file_type>application/x-ms-installer</file_type>
        <flow_id>6a8780c0befbfb13af7efd4f</flow_id>
        <hash>fe4bbe30d04c5c610b2cbcb830adfe6e7cc0d43e784df688b3fc06cd087fe1bb</hash>
        <iocs>
          <urls>
            <value>
              <url>http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedRootG4.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.digicert.com/CPS0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://go.microsoft.com/fwlink/p/?LinkId=2124703</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://wixtoolset.org/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cacerts.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl3.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl4.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>go.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>wixtoolset.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>23.11.40.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>45.60.121.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.67.139.212</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>72.246.29.230</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>162.159.142.9</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>15f7fc891b0be7649b8478a66c5076175481e2a38dedc5734b8f3b86c78c2237</SHA-256>
              <SHA-1>75c140d15730c5b4f1c37b5ef30c63ce064f9f21</SHA-1>
              <MD5>8fdfc035e9142300340f639481399abd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>4415a801858ba1b35a596816aefa5d88336255a2dda1380e7052a0765a47e2b2</SHA-256>
              <SHA-1>58a13fcc8d2906f29423c1d641f2a3b1757af295</SHA-1>
              <MD5>7b89df5cdcbcedaa020ef8956bf743ff</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df</SHA-256>
              <SHA-1>4260284ce14278c397aaf6f389c1609b0ab0ce51</SHA-1>
              <MD5>1e4a89b11eae0fcf8bb5fdd5ec3b6f61</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>4c6b49086eaf6bcc4337b7bced82ac1380cadad4156e1b90b2c7401a7f9f94e1</SHA-256>
              <SHA-1>9e2356e513111c953d0c2f0540b8bf079de8e79b</SHA-1>
              <MD5>84b4bcc452e2eb6bccd6791d302b7992</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>5337e8953a0f68a88b9491f6f9147ad6c1d3a532b28d1d55755dbb9486b3867a</SHA-256>
              <SHA-1>87710ae7898fd69892e28dc8b83f59a877ef1070</SHA-1>
              <MD5>4f44051fc9f3fbe402d5fb10291a94e2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc</SHA-256>
              <SHA-1>d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57</SHA-1>
              <MD5>cfbb8568bd3711a97e6124c56fcfa8d9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>8e25ceef6099764791a010adb84eea74ddf7c440c14eb7be6507a2dbd55be289</SHA-256>
              <SHA-1>274f6b1e34d1da4e639130816e3f0b07a33061e5</SHA-1>
              <MD5>337ba75c33de530112e14dcaf45e2ebe</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>a961ff27aa61c4a304927907e62949be2eab60003da2d5b85f3a3778e0a0f1f4</SHA-256>
              <SHA-1>6a06bed27445255703631bc80c325fa6be0801b3</SHA-1>
              <MD5>38b25d0f2277ea00fe0f66a4a486a494</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>b1cb832f790c153aa0e9a66f76e75460263cf1d41971d2dbcc9a4d87ec18b7d8</SHA-256>
              <SHA-1>2a4224d31c916a5cff4f2636a3cb47fdd84a5cc9</SHA-1>
              <MD5>01e4c8c046a47771f13cd120b53303e7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>b86b1fd03c5922ae01312cf5de26f60573b52a6e905db3e03e2b00bafe2da8d8</SHA-256>
              <SHA-1>9d6cd0bf7e27204515ad322b151ab03729f14e23</SHA-1>
              <MD5>44cc4a2486731238a5499bcfc85a748a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c84b9eeec992830649e11f5a7743a992ac28913b7eb0d2c3bb907c9c8cadfcc8</SHA-256>
              <SHA-1>ab2e69e3564ab6ced51c95a3f46fa0682cb48130</SHA-1>
              <MD5>1973b28fbc90c8facf5ce99cb2a83380</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>c998957562045d593156fefc2d83103ad945f2db3abffa2a5e18cb021539b977</SHA-256>
              <SHA-1>9753412e5cb4f7dc056b6e6301f68a1e9d394dd5</SHA-1>
              <MD5>c058d02cae8163400bb623ace9b4a6c8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>fda3a5a51bcbb3e4e42d37383e8622d8bdaf001e9ebaf4be1bd348891de6f05e</SHA-256>
              <SHA-1>171accc0c0b6f9a4bf4a14844d29da0bf149d35a</SHA-1>
              <MD5>36025b78784d2f8673d0d6b271a5ce3f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>023452F3-CF51-4E08-A8FA-4E55D11FC5D9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>03D1E657-281B-4D12-A36D-843FA6C18D6A</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>063716B0-C803-5A4A-83CD-225F9585FA08</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>0CF4AB04-9AC7-5EF7-8795-AF8513F64A82</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>25FD1782-67B0-4F5E-A445-F75C66F55AB1</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>2CB1B204-3BE9-471F-8E9E-069E0726BEBD</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4E4FD8C8-FCF6-5C17-8944-10871A85E2D8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>56ECB5EC-B476-4732-BFE7-EED1FCC6862B</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>676DCF54-0377-46D1-B764-34D0E01A8357</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>7D9245D6-89E8-5336-BE66-724CD8A234F0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8A7E4BAA-F14C-49F7-9BAB-BF3A672907C0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>98C55342-5871-536C-93E7-B19875DCA187</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>B7EF42AC-D313-4AD4-ACB6-8611D67E58DE</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>F1D36E5E-C142-575F-BD88-D9CFE0217A47</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>F3017226-FE2A-4295-8BDF-00C3A9A7E4C5</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\Policies\Microsoft\Windows\Installer</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>Cloud.v2.6.6.msi</name>
        <report_id>9be6645c-d046-49a2-be9a-9a9d04a64361</report_id>
        <tags>
          <value>msi</value>
          <value>keylogger</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>installer</value>
          <value>expired-cert</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9ff47754c73b5d487eb527b4d351d428b08cf5d0876cd878a69be725a355e372</id>
    <title>Analysis Report for 9ff47754c73b5d487eb527b4d351d428b08cf5d0876cd878a69be725a355e372</title>
    <updated>2026-08-20T22:32:07Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87809df2677ae4d366d901</_id>
        <file_type>application/vnd.android.package-archive</file_type>
        <flow_id>6a878067b107fd4d6e901e77</flow_id>
        <hash>9ff47754c73b5d487eb527b4d351d428b08cf5d0876cd878a69be725a355e372</hash>
        <iocs>
          <urls>
            <value>
              <url>http://ns.adobe.com/xap/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/mm</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/sType/ResourceRef</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://payments.google.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://wiki.redump.org/index.php?title=Useful_Links)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://wiki.redump.org/index.php?title=Useful_Links).</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.yabause.org/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://yabause.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://5n71v2lg48.execute-api.us-west-2.amazonaws.com/default/getTokenAndDelete</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://b472u.app.goo.gl/YJ5F</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/orp-j3lNGj24xvfVBEQvwWyaVhOQ_aTGc0nwIInDXBlNGUnSOdB_hb8sPGSmgmd0Jvkx=h310-rw</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://uoyabause.firebaseio.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.uoyabause.org/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.uoyabause.org/static_pages/guide)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.uoyabause.org/static_pages/guide).</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://xdfvpye4sb.execute-api.us-west-2.amazonaws.com/default/getLoginPinIn</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>5n71v2lg48.execute-api.us-west-2.amazonaws.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>b472u.app.goo.gl</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>lh3.googleusercontent.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>ns.adobe.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>payments.google.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>uoyabause.firebaseio.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>uoyabause.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>wiki.redump.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>xdfvpye4sb.execute-api.us-west-2.amazonaws.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>yabause.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>smiyaxdev@gmail.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>44.225.117.181</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.132</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.21.35.119</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>52.38.134.197</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>62.141.35.244</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>35.201.97.85</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.92</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>34.221.3.129</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>fb796c7f13038c06e56bfee2b7dcd1e85f57161980b32066974dbb29fea8acf5</SHA-256>
              <SHA-1>2aff4a0db24a42792b84d13bbc6f6a128a76ef3e</SHA-1>
              <MD5>b753478e4cf562c65fb0d359bf6693a0</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>c4b018897830a38cd8f643414fc0292b3c331e469dc6eddd88f15a684e7f93a1</SHA-256>
              <SHA-1>386a6fe39f629792698d18f2d34e24211f44788c</SHA-1>
              <MD5>86ce34cc7414cdbbb483bd1ef1bcaf35</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>fee014c05e753db43c335cb7351bf5b541361cd8b01af959730f1546dcaae545</SHA-256>
              <SHA-1>2b0e4334d7a4f45c2ad709050e3a6af6676a6400</SHA-1>
              <MD5>31527c31cfbee5497e4d1827f4edccdc</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>12a22880bc2e59f8278b4a5e547567f0aa14d020ea456598267fa00208cfebc5</SHA-256>
              <SHA-1>6ea226ea9c42e1cc7e668b33bd7c6c0a5c205b0f</SHA-1>
              <MD5>bc45704aad57d445b6dfa58b101071e3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/json</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>ddf5b9f3-f60b-c14b-b238-46ef1adc2ffb</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>f2cf4402-037e-e24d-82fc-16cf0d9188b2</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>Yaba+Sanshiro+Free+-+Sega+Saturn+Emulator_3.4.2_APKPure.apk</name>
        <report_id>12624701-a975-46e2-b0fd-3faaaf27c09a</report_id>
        <tags>
          <value>apk</value>
          <value>html</value>
          <value>json</value>
          <value>signed</value>
          <value>anti-debug</value>
          <value>base64</value>
          <value>crypto</value>
          <value>evasive</value>
          <value>fingerprint</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>4b29e67694824907522aff6397534cf4d22d54896b945a7d1844f48af89b2c00</id>
    <title>Analysis Report for 4b29e67694824907522aff6397534cf4d22d54896b945a7d1844f48af89b2c00</title>
    <updated>2026-08-20T22:32:01Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878093f2677ae4d366d8fc</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a87805f009ae7a1a8d2f68e</flow_id>
        <hash>4b29e67694824907522aff6397534cf4d22d54896b945a7d1844f48af89b2c00</hash>
        <iocs>
          <emails>
            <value>
              <email>nolY@F.8M</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>0c90ed09db3ff455b2d684aaf489f366a14ba8c3b7fa3e7e0cea27fe9c82dd71</SHA-256>
              <SHA-1>4606da709ace5c98160edca3593f5aea9bfbfcff</SHA-1>
              <MD5>cf827ab9deb647913237045cfa841cbc</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>16c6d3cf02803d67929ffb6ad2abc3913bd52583802a10b2782e9233099c61ad</SHA-256>
              <SHA-1>7f11e496b205cb24dd6ae4314ef96128e67a227d</SHA-1>
              <MD5>fa4afc6abe95e8971e039f30a8768d41</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>1b4f90737db44443573a5638ecb00877840a2a53022e44a2f55c9c0763f839b2</SHA-256>
              <SHA-1>b77ceecd2a3ea6e24d36e4c800e8e9b377d013c8</SHA-1>
              <MD5>d4c3c48b616b752631ce4b66bc64c95a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>1f862cd3ff66f55d4ac5ede1ecc4d3fc78784afb191c3370abea556fc0dcdc22</SHA-256>
              <SHA-1>0dd1f5728020cea5386f1d76301749d7226682f3</SHA-1>
              <MD5>321ae4c36ffbe264d32013921e401152</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>30c0909e9636d16920f5c045cf9cb6af103924752d3c19edce0ccfae01ff0100</SHA-256>
              <SHA-1>acdb7b9065e9423649b3b0cae28de12038b31ec7</SHA-1>
              <MD5>436360edc29d5730780ada90de422839</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>54f1d140b9d2d84a3c145ee525741f98549ddcf3adcd9c4fbc919ec1782b31e7</SHA-256>
              <SHA-1>1637551b882445888ae46ae4100ab788600593e5</SHA-1>
              <MD5>f717f8caa074daba1206266e9bd62464</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>6124754533fc9c284f2a5450c8779515d2df01d6050c904190c1f3c83b82fe29</SHA-256>
              <SHA-1>a27cf615d6f269542419cb1460b2bba56c8df1ea</SHA-1>
              <MD5>523bdf904482948da6b1eee5a66807d0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>634d5e5ae8f65bd2d286b2014429cb79fdd7b43b8b95dd72fc27db6981c36ba4</SHA-256>
              <SHA-1>1991d6891c361e8ae42c1d27409ed8edf651ed66</SHA-1>
              <MD5>3bc29beb17a253a4e961bed584266e63</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>7af8382ba1f13865152147e480f00117dad27c5ec04db82b4990f1ab1513ae43</SHA-256>
              <SHA-1>44276b7a38aabf02d9b1a553488020f68ef17a08</SHA-1>
              <MD5>2fe2e99bd9ce48bb7357d769b8ec1b57</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>7d514813bd1f6ba5477cb70d04552dd0ade6b380ca71aed1fa2216177ce2084d</SHA-256>
              <SHA-1>b0bfa201524635e354d584ae6f84bb792b992e7a</SHA-1>
              <MD5>38e6459082a7504e05c0709372279adc</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>8a5e9c8a95b6018f98bb54d6a2231ced4455ae36a68261b58eb4002bc6ea953f</SHA-256>
              <SHA-1>c937f3196b1cfe0b2d9829c462a069d733b5ebe1</SHA-1>
              <MD5>610f05e8ddbefe4daf9af941ccf41c34</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>99880fec5a7a75f1e02a781f999b729eba6a23764b5ecf5d1077df99c0c90315</SHA-256>
              <SHA-1>029c838e09e5a66c384a464a7464d7c542768c04</SHA-1>
              <MD5>8786ccac16691be38e551375bbf77354</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>9e3d3ed4d87056653383890809758b20336729c6821013c5e58064ff5193282e</SHA-256>
              <SHA-1>00daad5485f0999a59b2e1ffebb6b7315638cc93</SHA-1>
              <MD5>74bc450b661ca6e3be2756266f018575</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>abb8df58d226ac0570cb4e1ca62f13befa2be29c1c99a7ae46115921b7fa7e22</SHA-256>
              <SHA-1>20ad190df6f9282a8a8db2e304b7abdacfcd18c5</SHA-1>
              <MD5>1ca1460340dd9d13f49dbc2a61c98f5f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>c33969ba3bbc5a4f25be8a83a6a87cbb4a0c1a0282646fc26153fc75100384f4</SHA-256>
              <SHA-1>cccd50e10298f6a7c9e78c392d85be7203b27073</SHA-1>
              <MD5>c63ce41073815ec4722d2a38ef67208a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>c5dea43f837139185e9312efc8ee1eefe1d24a999d62a4f1cc5ef1767cacb403</SHA-256>
              <SHA-1>305a6fbc24fb55bfa92c6c8ad60a7a78b1ab891f</SHA-1>
              <MD5>bde660a2176e41cb9ddb285115058518</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>ca82878ac6f8f5d26249f03257b496eebf06e2d20e02349a0b871bf92766535c</SHA-256>
              <SHA-1>53f3b4b4b61af9cde9de74a33fbc492c71f7660c</SHA-1>
              <MD5>a6469ac97a109b7c2bc1bf3020168af3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>d8c87e98057c5a7d71a609f00624342d840ec7ca11d3afefe82570d8696d16d7</SHA-256>
              <SHA-1>908881fe8185443ec1a9983fd7d9fae30b1aef63</SHA-1>
              <MD5>10d37b98d4897fd7d09029484982fdc7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>e4d648f0fa609cf99b82ad140e14e1695c32da46f676ad8f8ee5fce8ca923c83</SHA-256>
              <SHA-1>58554b258683fa6fcce8c9f955cb36e0af704f41</SHA-1>
              <MD5>3590e31fe7b7aeead9d768c4ee5f1bcd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>ed63f374b00c3547231a99729bfc3d9b1715078335e35c11c3c8722e592d1c9d</SHA-256>
              <SHA-1>eb2cc185aa9f5ae9ac8886233993643cf012f16c</SHA-1>
              <MD5>86418f67c6c2d96dc2e2d92cc304d04a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
          </files>
        </iocs>
        <name>SPLATTER SCHOOL.exe</name>
        <report_id>89e1a717-d6f9-4b94-8710-18552e4902db</report_id>
        <tags>
          <value>peexe</value>
          <value>packed</value>
          <value>installer</value>
          <value>adaptive-context</value>
          <value>overlay</value>
          <value>microsoft_visual_cc</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f3f52486e4bfd00d3f2d6a71194383fe5ad515785f045aaccc00175cd5dfa822</id>
    <title>Analysis Report for f3f52486e4bfd00d3f2d6a71194383fe5ad515785f045aaccc00175cd5dfa822</title>
    <updated>2026-08-20T22:30:08Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87801ca7edcf8232f85fe4</_id>
        <file_type>text/x-shellscript</file_type>
        <flow_id>6a877fed009ae7a1a8d2f61a</flow_id>
        <hash>f3f52486e4bfd00d3f2d6a71194383fe5ad515785f045aaccc00175cd5dfa822</hash>
        <iocs>
          <urls>
            <value>
              <url>http://45.95.147.178/z/wr.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>http://160.119.69.4/z/post/noroot.php</url>
              <origin>INPUT_FILE</origin>
              <verdict>MALICIOUS</verdict>
            </value>
          </urls>
          <ips>
            <value>
              <ip>45.95.147.178</ip>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>160.119.69.4</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>06f27a230794ed71e7c50a242325985ca7cf9a966157f894275f3de3c3b61fbd</SHA-256>
              <SHA-1>5e894696c22aa9606d726dba617b3a904fd8cf8b</SHA-1>
              <MD5>e14b8b7cc3eabc89e166c3766c0b0e90</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/x-shellscript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </files>
        </iocs>
        <name>f3f52486e4bfd00d3f2d6a71194383fe5ad515785f045aaccc00175cd5dfa822.sh</name>
        <report_id>9037aa21-d66f-4294-9674-4c32fa07d84e</report_id>
        <tags>
          <value>shell</value>
          <value>evasive</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>206edc654ebdc1b362ca30966d53a95098c0f6500797ebb83848f2951956fa46</id>
    <title>Analysis Report for 206edc654ebdc1b362ca30966d53a95098c0f6500797ebb83848f2951956fa46</title>
    <updated>2026-08-20T22:30:05Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a878060a7edcf8232f85ffb</_id>
        <file_type>text/x-shellscript</file_type>
        <flow_id>6a877febeeadd95beca17dc3</flow_id>
        <hash>206edc654ebdc1b362ca30966d53a95098c0f6500797ebb83848f2951956fa46</hash>
        <iocs>
          <urls>
            <value>
              <url>http://160.119.69.4/hima_data/index.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>http://45.95.147.178/hima_data/index.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>http://45.95.147.178/k.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>http://160.119.69.4/x</url>
              <origin>INPUT_FILE</origin>
              <verdict>MALICIOUS</verdict>
            </value>
          </urls>
          <ips>
            <value>
              <ip>160.119.69.4</ip>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>45.95.147.178</ip>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>160.119.69.4</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>f78003a33ef6ebdcca9d1305f1be98dfd3226eff9a860091ad6d6f80c98c7a39</SHA-256>
              <SHA-1>231e1a1c7b01072ca3d712202792b4d61a36a227</SHA-1>
              <MD5>518f22a0066cb2374f922d7dd7649d41</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/x-shellscript</file_type>
              <verdict>LIKELY_MALICIOUS</verdict>
            </value>
          </files>
        </iocs>
        <name>206edc654ebdc1b362ca30966d53a95098c0f6500797ebb83848f2951956fa46.sh</name>
        <report_id>6a99ca8d-10b2-4bd3-80f4-df556f8a9ad4</report_id>
        <tags>
          <value>shell</value>
          <value>base64</value>
          <value>obfuscated</value>
          <value>evasive</value>
          <value>bash</value>
          <value>lolbin</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a2797646777e379eb72fdd6f81ed1988216e191d7cee04e5b022d77d796886ea</id>
    <title>Analysis Report for a2797646777e379eb72fdd6f81ed1988216e191d7cee04e5b022d77d796886ea</title>
    <updated>2026-08-20T22:30:02Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87805da7edcf8232f85ff7</_id>
        <file_type>application/x-msdownload; format=pe64</file_type>
        <flow_id>6a877fe9b107fd4d6e901cf9</flow_id>
        <hash>a2797646777e379eb72fdd6f81ed1988216e191d7cee04e5b022d77d796886ea</hash>
        <iocs>
          <ips>
            <value>
              <ip>5.1.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>146.75.122.133</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.21.226</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.20.226</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.230.217.38</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>146.75.118.133</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>2e89cb5b2a93c11b994b8fc7f03c2998c81c19845e828fb1cbf9665ecf408473</SHA-256>
              <SHA-1>cdbd0cde006c3f5704a4f05396dc91b6de22f3e3</SHA-1>
              <MD5>359808472af1b4328b6ee3cdbc8b47e1</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>6364608a92559464cfea77f507425137998647f0f36ac9931d473d189aacd432</SHA-256>
              <SHA-1>e77e9ea5803aab42d2cadcccac37550303318b9f</SHA-1>
              <MD5>3e224b500f18867fefeae2a71a774347</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/vnd.ms-cab-compressed</file_type>
            </value>
            <value>
              <SHA-256>76308a7fa5d066ca2f434e4f783c86f34cc36dbfdaf5cc34a579cf8984093312</SHA-256>
              <SHA-1>c7ded15cc300ea9c6a0cc90f662f0c7ae031006c</SHA-1>
              <MD5>25326c60148f907b8a2f7648d3ec999e</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>989a7453d438236af7fce58fff13af8f81346a5d4bcb68e08400e549dcc9419a</SHA-256>
              <SHA-1>41cb4ee965ac039e0e8fc09efbd4f7dab6892bb6</SHA-1>
              <MD5>a775c908b6d8d92c4e6206f89de1c74a</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>9d9f290527a6be626a8f5985b26e19b237b44872b03631811df4416fc1713178</SHA-256>
              <SHA-1>8e146c3c4e33449f95a49679795f74f7ae19ecc1</SHA-1>
              <MD5>edcfae989540fd42e4b8556d5b723bb6</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119</SHA-256>
              <SHA-1>9069ca78e7450a285173431b3e52c5c25299e473</SHA-1>
              <MD5>f1d3ff8443297732862df21dc4e57262</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>eaadcdd05a9a7c7f80d53d758f39e4399749d774b09a8a0165fe7c69ad6d8c3c</SHA-256>
              <SHA-1>0445b1735fd9797d537d360695940c7e68d25ace</SHA-1>
              <MD5>527eeaa35a23dd5cac9bddcc2561a457</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>545e33c42c1fb826cde22746a58601bb4a514dcf430851ca8249e33b34478293</SHA-256>
              <SHA-1>65fac965ff8b1c57725aa3ff00c47d4b52f03949</SHA-1>
              <MD5>3eaaa58150bf3e2849d17ec6f20f50a4</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45</SHA-256>
              <SHA-1>b1ff3d48a3946ca7786a84e4a832617cd66fa3b9</SHA-1>
              <MD5>8fa52f316c393496f272357191db6deb</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <SHA-256>5a940690b5520ae13d1bbb31fc4d2f01a9a8e16f827cec21778ca665c5a2f1b2</SHA-256>
              <SHA-1>ef698fa11d6eba19918361cc0c51b7fff85f8ed7</SHA-1>
              <MD5>b7a2d4496c4e32e9c9dbc6af80753fa8</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/x-msdownload; format=pe64</file_type>
            </value>
            <value>
              <SHA-256>bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128</SHA-256>
              <SHA-1>8c015d80b8a23f780bdd215dc842b0f5551f63bd</SHA-1>
              <MD5>5bfa51f3a417b98e7443eca90fc94703</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/octet-stream</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>863b1b5ac3a0ec5597f60ddf3071d10c9960a98850c2b4f70c0b5109901813bd</SHA-256>
              <SHA-1>008956a58a1b1ada3d725b982588f072086acb8c</SHA-1>
              <MD5>c6082405b741e98693628dfe2f5163b9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\App Paths</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\RunOnce</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>System\CurrentControlSet\Control\Session Manager</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>System\CurrentControlSet\Control\Session Manager\FileRenameOperations</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>a2797646777e379eb72fdd6f81ed1988216e191d7cee04e5b022d77d796886ea.exe</name>
        <report_id>cf38afdc-5f51-4e64-9f27-65dae3fc7d06</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>data</value>
          <value>keylogger</value>
          <value>stealer</value>
          <value>adaptive-context</value>
          <value>packed</value>
          <value>anti-debug</value>
          <value>rundll32</value>
          <value>reconnaissance</value>
          <value>fingerprint</value>
          <value>explorer</value>
          <value>lolbin</value>
          <value>runonce</value>
          <value>sfx</value>
          <value>CAB</value>
          <value>installer</value>
          <value>autoit</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>4771e86ff868deb5ce330941918ecde24d8fcbd30b082caf797ff1ae67bf420f</id>
    <title>Analysis Report for 4771e86ff868deb5ce330941918ecde24d8fcbd30b082caf797ff1ae67bf420f</title>
    <updated>2026-08-20T22:29:59Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877ffaa7edcf8232f85fd9</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a877fe6009ae7a1a8d2f612</flow_id>
        <hash>4771e86ff868deb5ce330941918ecde24d8fcbd30b082caf797ff1ae67bf420f</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schemas.microsoft.com/SMI/2016/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>2237070aad8d589c88c94db4fb267b979d5add756539f5cbfed5fe246fc74f73</SHA-256>
              <SHA-1>e084f7a9218e076945167f87d3a093400a0e3b9b</SHA-1>
              <MD5>53a580c225af810758c1cbda1d5afb28</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>5506fb2d83f6c70aa02f8588e692224e0a60e6db54c34f245de954d4154da099</SHA-256>
              <SHA-1>9a956aa85b276b7e4cc9321482b9f59d6e080d75</SHA-1>
              <MD5>e9b9ca486037b108563abf118b3c8250</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>69e3cce41758187e0d60deac0d57f675904686106ce49a345c5bdb61ed608d01</SHA-256>
              <SHA-1>f33b1005e31bb6e783712ee0b755051bfc03ad7d</SHA-1>
              <MD5>8785a1ae7b4c6879b7e99b5630a5f695</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>9aa4c50497d645969e99c38ce959158d0846b42578e9d330dba5c609217b69ed</SHA-256>
              <SHA-1>30b1474e6a86ee05b12658ef32a47b555cacaf1d</SHA-1>
              <MD5>b08b4f2611b86a52cc039648b7702263</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>abf8f2022f12f350789d961aceaf9ccfd53e7ec58d8c9934cfce77779b4eac11</SHA-256>
              <SHA-1>5f8991f3e065fd95614859a293f88b9c70e4bb23</SHA-1>
              <MD5>84da8dee6b319ea0b10b6de5489c6aae</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>bedda27dbcb927713b7dc48ac9359ddf71976495ef23a5ae9e7568cd4d853fc2</SHA-256>
              <SHA-1>2b522e9a94bd29c8af6b24aa5a8d91af8986f646</SHA-1>
              <MD5>451e669d792d52b84516e6b5b025a2de</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>cb889ffb9270aece35738bfa0f102c3c51ca5d5f36e61c81cd6b9d6152566004</SHA-256>
              <SHA-1>6c192148c95dcc3cccc47e1ec7bbcb3969af2033</SHA-1>
              <MD5>a7325b19e05a6fc6376d3d93dba89c5d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/zlib</file_type>
            </value>
            <value>
              <SHA-256>e872dc094d87b869f069841dd17c96a796dc6f5b1bfcbb5468ab42787361a8cd</SHA-256>
              <SHA-1>a29bf86a6a627aa7f6305287446e961a47c9e175</SHA-1>
              <MD5>0ce5bf95890e9b55743e2db5f14d8e80</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>ea095af457d1b9b0c4ec0d4885d10aa829535a109b3eed2f497b19b9fc561669</SHA-256>
              <SHA-1>2b5261d861774075d55b23624d8e04344cf3c620</SHA-1>
              <MD5>0069236bf8f4be0cfe2427784abd122f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>4771e86ff868deb5ce330941918ecde24d8fcbd30b082caf797ff1ae67bf420f.exe</name>
        <report_id>562554f9-3bd8-4b82-a7e7-d7bee85c6436</report_id>
        <tags>
          <value>peexe</value>
          <value>dropper</value>
          <value>adaptive-context</value>
          <value>expand</value>
          <value>lolbin</value>
          <value>packed</value>
          <value>reconnaissance</value>
          <value>overlay</value>
          <value>microsoft_visual_cc</value>
          <value>pyinstaller</value>
          <value>anti-debug</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e2308a88b3257b64b1e0968b0589566c87b32c29fb8eaa2a521c7873bd68116b</id>
    <title>Analysis Report for e2308a88b3257b64b1e0968b0589566c87b32c29fb8eaa2a521c7873bd68116b</title>
    <updated>2026-08-20T22:29:37Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87800fb4681b3ab7ee493a</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6a877fcfeeadd95beca17d9e</flow_id>
        <hash>e2308a88b3257b64b1e0968b0589566c87b32c29fb8eaa2a521c7873bd68116b</hash>
        <iocs>
          <urls>
            <value>
              <url>http://viveelritmodelpacifico.co:6606</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>viveelritmodelpacifico.co</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>188.114.96.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>188.114.96.3</ip>
              <origin>MALWARE_CONFIG</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <MD5>e08858b52a1f2a752be6cee3d54fb425</MD5>
              <SHA-1>052a989a54dea5029369110ec19c7d8d2c2e2135</SHA-1>
              <SHA-256>06865966a7d998cd3481f29797b4dd7e5609956136716b612d55be2ea6dfbb9d</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <MD5>2865965f87dde17cf3060143c6c8bdd5</MD5>
              <SHA-1>e29d122cc8aacf44db5e2f5911eac141710b2572</SHA-1>
              <SHA-256>1728f6c2c9187fc24a5a644dc493778862697c80d778bcb2d652aee259f37e5a</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <MD5>d6d3870dcf8c912a636bf4006140623f</MD5>
              <SHA-1>394195dd8e26f36459245e0b2dd631e0b2450bfa</SHA-1>
              <SHA-256>2b7414d146c15b58705c6e608cee698ded4ea9f4acb04527e53311360ca1b473</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <MD5>19cca992054777ce7ff6d74a4cfa26a0</MD5>
              <SHA-1>aa5e57342ba5093d246ad34fcc779779da626c9e</SHA-1>
              <SHA-256>300c6bd5cbb3b69e8f8e83140904af9283deaebf8cedda9945a2d3c1d28fa5b3</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <MD5>2c4f26b97d78c26b364249c225de3215</MD5>
              <SHA-1>5f29f2769a031b0dfd706f48f1df10f661bf4012</SHA-1>
              <SHA-256>38e41093e3615b8987356195aeedb84e0dea619ec2a2625e3a947bc1e0bb7f49</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <MD5>11acb44bf0e4aed25993eb2f293dda2f</MD5>
              <SHA-1>b408b317001f439348344cec06f3b2ed803ff998</SHA-1>
              <SHA-256>3feb52740d9778d3175584aec4bfa161ce6038deb508c8f250e88e7f4124d643</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <MD5>48e2e808f11ed00010db35d411626c20</MD5>
              <SHA-1>8345d077cb8deacd1ce1e4d434f2a013ade867e8</SHA-1>
              <SHA-256>43442a4922399ace3f6ff228d1324e26706de961f944720f5be04465d2d4b2b7</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <MD5>a9e448562c403909a60aa0400d8b46cb</MD5>
              <SHA-1>d36b8745e87fdceb340854e982add2d78fafde80</SHA-1>
              <SHA-256>4d1cad545d25a3c7d166f79832fec1ecade4e87e554a8b77e38be64d5e5fd579</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <MD5>e27382642b6d2f1d7c46cb520f369587</MD5>
              <SHA-1>04b71f5926ab0065e3315868f1a47503c8e6d2d1</SHA-1>
              <SHA-256>4e497cbf17a992ed7e6afcf5ddeddbdc46c74ff5f8d4ab1df4af62216e191670</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <MD5>7e1112433165fd72ff1486f8c2833258</MD5>
              <SHA-1>6f21c25f35f5b3ab88fdec973e34263f1dca9c8e</SHA-1>
              <SHA-256>5a61d9553c77bef31582e877d8be37e424d82b248a52a7694492ba9b09e14abb</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <MD5>a0a45e731c6d9e82a195d86d40e0d0e4</MD5>
              <SHA-1>c5f1df249c04828d470abc5fb943189d2a1a2161</SHA-1>
              <SHA-256>62d283c89db3b8f4a9a6122f95ccb05463ba4230a7364b18960436e2af7839a5</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <MD5>0c2933a05e167c35f83a2d674e70c50c</MD5>
              <SHA-1>310da27e37cdb29739589bc9e9e94eac03e22b3c</SHA-1>
              <SHA-256>6ab7b2470a864ac69069a37e66d2e79827dc7663bd97f2548b7d37afd9fc6169</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <MD5>f9fa141adaa7e1300c8701eb624299db</MD5>
              <SHA-1>a66fa63352d49853cf16ca119c8afef07c3052b3</SHA-1>
              <SHA-256>8ded0858afee950406190f84c67d162f05c74b3ba1e94e18cdab9f5b83035e49</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <MD5>12f5225aa786966d042deac9fb7a11e0</MD5>
              <SHA-1>5f040ccd2aa218707b87bcde85e58fddc6cbeb11</SHA-1>
              <SHA-256>9c56fe2b44e1d0367b98c2c5ee2255aebbd7093902bffed36aa36e3431b40fb5</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <MD5>b935e1db1f2a493136154e0715a78d3b</MD5>
              <SHA-1>b7d4589a9fcf48980b849c810c3af04ee11d07e4</SHA-1>
              <SHA-256>b12ba45514fa8c048792c817d6e71b343a9bfb73cfd288bd63ae33b145bcc9f0</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <MD5>80b98804aa927e7e28c43cce657a22a1</MD5>
              <SHA-1>40f5be6a42b8f6a82a576f41f4bb75124ffd46a3</SHA-1>
              <SHA-256>b57f619cbf9fe7a3b8561c5dda277ecd0686842cb40b63b5b44ead61474b9858</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <MD5>23a5c08ff5558f496125b00736870c90</MD5>
              <SHA-1>ebcd872c7306b28661d91fc270ff5d7b3c6f819f</SHA-1>
              <SHA-256>c1a128f1abbb5a73b0d336496e62d881a064c2f7ec0119554994ac807fdae1fd</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <MD5>e8b200ac73edcaa4fe0c9eb3053bb872</MD5>
              <SHA-1>5cfa33d0214a220e2f9c76eb74659eae30c7a61f</SHA-1>
              <SHA-256>e6ae43146bc363253aca4fce44a5415b4830afbdcd3bdbde770a2a334898db0b</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <MD5>1a26e08db36e24cd76e4aa74121c621c</MD5>
              <SHA-1>6a926a45bfc6ca618bdaf58e1516fd39b571e549</SHA-1>
              <SHA-256>f1c0c3e95786f23c688c486d118d21e457447aa2276ae407d51dacb2da24019e</SHA-256>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <eth_wallets>
            <value>
              <eth_wallet>0x20990:$eth: DEEEEBEBEBEBEBEBEEBEBEBEBEEEEEEEEEEEEEBD</eth_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </eth_wallets>
        </iocs>
        <name>AsyncClient.exe</name>
        <report_id>c18e3bf3-8543-4c35-b14d-63c1d89d40be</report_id>
        <tags>
          <value>peexe</value>
          <value>dotnet_pe</value>
          <value>asyncrat</value>
          <value>config-extracted</value>
          <value>reg</value>
          <value>fingerprint</value>
          <value>anti-vm</value>
          <value>base64</value>
          <value>reconnaissance</value>
          <value>adaptive-context</value>
          <value>lolbin</value>
          <value>packed</value>
          <value>schtasks</value>
          <value>obfuscated</value>
          <value>vbnet</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>eb4745a06fad470dcdfd1a888064900d9cf8dbb30caab46b702b2aeddec7e4e6</id>
    <title>Analysis Report for eb4745a06fad470dcdfd1a888064900d9cf8dbb30caab46b702b2aeddec7e4e6</title>
    <updated>2026-08-20T22:29:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877fe9f2677ae4d366d8d6</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6a877fccb107fd4d6e901c93</flow_id>
        <hash>eb4745a06fad470dcdfd1a888064900d9cf8dbb30caab46b702b2aeddec7e4e6</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schemas.microsoft.com/office/2004/12/omml</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.w3.org/TR/REC-html40</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://betterwayapostolic.org/?u=npe2b76keijadgb4zhtikba</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.azf-gruppe.de</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.facebook.com/AZFUnternehmensgruppe</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.facebook.com/Audi.Zentrum.Flensburg</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>file:///tmp/tmp6mh30529.html</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>azf-gruppe.de</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>betterwayapostolic.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>facebook.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>w3.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>rechnungsausgang@azf-gruppe.de</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>info@foto-erhardt.de</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>info@foto-erhardt.de</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>159.69.122.20</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>13.93.42.39</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.66.133.208</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>157.240.253.35</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.23.19</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>50.6.154.109</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>948dfa14e7f7034a8dc03ccedb9fffdc9bf3f16c5de29981a9470cbe7fa1cad9</SHA-256>
              <SHA-1>5f921fdc8ad18b58ee1058cfe5c91e19357dda6e</SHA-1>
              <MD5>f85207d56f1f54f10d9066a5011a3f79</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/html</file_type>
            </value>
            <value>
              <SHA-256>4d85ad1fee6004ec6f94e184288357d36ad56a76cc4bbe4f81b0da9adae39d21</SHA-256>
              <SHA-1>d9dab251fce395a087873725daeaa39535195c99</SHA-1>
              <MD5>041751de3c20848c9a2670820dc2765d</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>application/xhtml+xml</file_type>
            </value>
            <value>
              <SHA-256>2d12995932e949c1f98438b28e38d2eaccd18b472a7bf6456d19bb737c3f38db</SHA-256>
              <SHA-1>900238b56a792e6ed5755931be9eb315229bcef0</SHA-1>
              <MD5>28ee09d8e27a41b781339481ee5c137a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>cdebebcb5e9cd3e11d14e7926cc791816b75c6ede2afce471bd4fecf3255f455</SHA-256>
              <SHA-1>a741f3e9cfa9c28e4a86c890abd53cc2c84a6abb</SHA-1>
              <MD5>6900975c0883c6f34c944b85ceff0d4f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>1260b951840cf6081025d69f3527d2736eb0f0b123b325006c32a05e2ecb73f7</SHA-256>
              <SHA-1>6229afcd5f1c0f5a8c389cc81d789dc8a8d6245c</SHA-1>
              <MD5>2a8568addd385a5c4219d84e84d018c7</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>a7687a251145a17002e28c45b299b963ee9752bccab22ef232ffe588be17ad8c</SHA-256>
              <SHA-1>851c4dbcc909174f8121ccf7caca3354bc1ba26d</SHA-1>
              <MD5>be405608cd72378b028943107a9a8921</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>4964b9156a21b8cf3c00deda0cc701faed245808a4c3baec296e9d7042f00497</SHA-256>
              <SHA-1>919f7fc00c96e1c8600b2ee123a9ec90d1dad5b4</SHA-1>
              <MD5>8d97e5ec69e701cca19670cf3599ee97</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>12326423-524d-3e3f-3729-68e935641087</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>1740d202-88ef-4968-8f20-08de85eb7fbd</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>1cc0bd09-4286-382f-fbc7-a083ec2c34e8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>bd02f28c-8640-0c2e-738a-700223df67fc</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>d86110ba-5324-4334-aaab-569ef955e643</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>d877541e-9f8a-4958-7f0c-08de85eb7d4b</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>submission.eml</name>
        <report_id>30bdfeff-c519-4e31-b2db-a643c9d57ab9</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
          <value>html</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e2308a88b3257b64b1e0968b0589566c87b32c29fb8eaa2a521c7873bd68116b</id>
    <title>Analysis Report for e2308a88b3257b64b1e0968b0589566c87b32c29fb8eaa2a521c7873bd68116b</title>
    <updated>2026-08-20T22:29:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877ff7f2677ae4d366d8db</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6a877fbaeeadd95beca17d76</flow_id>
        <hash>e2308a88b3257b64b1e0968b0589566c87b32c29fb8eaa2a521c7873bd68116b</hash>
        <iocs>
          <urls>
            <value>
              <url>http://viveelritmodelpacifico.co:6606</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>viveelritmodelpacifico.co</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>188.114.97.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>06865966a7d998cd3481f29797b4dd7e5609956136716b612d55be2ea6dfbb9d</SHA-256>
              <SHA-1>052a989a54dea5029369110ec19c7d8d2c2e2135</SHA-1>
              <MD5>e08858b52a1f2a752be6cee3d54fb425</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>1728f6c2c9187fc24a5a644dc493778862697c80d778bcb2d652aee259f37e5a</SHA-256>
              <SHA-1>e29d122cc8aacf44db5e2f5911eac141710b2572</SHA-1>
              <MD5>2865965f87dde17cf3060143c6c8bdd5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>2b7414d146c15b58705c6e608cee698ded4ea9f4acb04527e53311360ca1b473</SHA-256>
              <SHA-1>394195dd8e26f36459245e0b2dd631e0b2450bfa</SHA-1>
              <MD5>d6d3870dcf8c912a636bf4006140623f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>300c6bd5cbb3b69e8f8e83140904af9283deaebf8cedda9945a2d3c1d28fa5b3</SHA-256>
              <SHA-1>aa5e57342ba5093d246ad34fcc779779da626c9e</SHA-1>
              <MD5>19cca992054777ce7ff6d74a4cfa26a0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>38e41093e3615b8987356195aeedb84e0dea619ec2a2625e3a947bc1e0bb7f49</SHA-256>
              <SHA-1>5f29f2769a031b0dfd706f48f1df10f661bf4012</SHA-1>
              <MD5>2c4f26b97d78c26b364249c225de3215</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>3feb52740d9778d3175584aec4bfa161ce6038deb508c8f250e88e7f4124d643</SHA-256>
              <SHA-1>b408b317001f439348344cec06f3b2ed803ff998</SHA-1>
              <MD5>11acb44bf0e4aed25993eb2f293dda2f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>43442a4922399ace3f6ff228d1324e26706de961f944720f5be04465d2d4b2b7</SHA-256>
              <SHA-1>8345d077cb8deacd1ce1e4d434f2a013ade867e8</SHA-1>
              <MD5>48e2e808f11ed00010db35d411626c20</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>4d1cad545d25a3c7d166f79832fec1ecade4e87e554a8b77e38be64d5e5fd579</SHA-256>
              <SHA-1>d36b8745e87fdceb340854e982add2d78fafde80</SHA-1>
              <MD5>a9e448562c403909a60aa0400d8b46cb</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>4e497cbf17a992ed7e6afcf5ddeddbdc46c74ff5f8d4ab1df4af62216e191670</SHA-256>
              <SHA-1>04b71f5926ab0065e3315868f1a47503c8e6d2d1</SHA-1>
              <MD5>e27382642b6d2f1d7c46cb520f369587</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>5a61d9553c77bef31582e877d8be37e424d82b248a52a7694492ba9b09e14abb</SHA-256>
              <SHA-1>6f21c25f35f5b3ab88fdec973e34263f1dca9c8e</SHA-1>
              <MD5>7e1112433165fd72ff1486f8c2833258</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>62d283c89db3b8f4a9a6122f95ccb05463ba4230a7364b18960436e2af7839a5</SHA-256>
              <SHA-1>c5f1df249c04828d470abc5fb943189d2a1a2161</SHA-1>
              <MD5>a0a45e731c6d9e82a195d86d40e0d0e4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>6ab7b2470a864ac69069a37e66d2e79827dc7663bd97f2548b7d37afd9fc6169</SHA-256>
              <SHA-1>310da27e37cdb29739589bc9e9e94eac03e22b3c</SHA-1>
              <MD5>0c2933a05e167c35f83a2d674e70c50c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>8ded0858afee950406190f84c67d162f05c74b3ba1e94e18cdab9f5b83035e49</SHA-256>
              <SHA-1>a66fa63352d49853cf16ca119c8afef07c3052b3</SHA-1>
              <MD5>f9fa141adaa7e1300c8701eb624299db</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>9c56fe2b44e1d0367b98c2c5ee2255aebbd7093902bffed36aa36e3431b40fb5</SHA-256>
              <SHA-1>5f040ccd2aa218707b87bcde85e58fddc6cbeb11</SHA-1>
              <MD5>12f5225aa786966d042deac9fb7a11e0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>b12ba45514fa8c048792c817d6e71b343a9bfb73cfd288bd63ae33b145bcc9f0</SHA-256>
              <SHA-1>b7d4589a9fcf48980b849c810c3af04ee11d07e4</SHA-1>
              <MD5>b935e1db1f2a493136154e0715a78d3b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>b57f619cbf9fe7a3b8561c5dda277ecd0686842cb40b63b5b44ead61474b9858</SHA-256>
              <SHA-1>40f5be6a42b8f6a82a576f41f4bb75124ffd46a3</SHA-1>
              <MD5>80b98804aa927e7e28c43cce657a22a1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>c1a128f1abbb5a73b0d336496e62d881a064c2f7ec0119554994ac807fdae1fd</SHA-256>
              <SHA-1>ebcd872c7306b28661d91fc270ff5d7b3c6f819f</SHA-1>
              <MD5>23a5c08ff5558f496125b00736870c90</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>e6ae43146bc363253aca4fce44a5415b4830afbdcd3bdbde770a2a334898db0b</SHA-256>
              <SHA-1>5cfa33d0214a220e2f9c76eb74659eae30c7a61f</SHA-1>
              <MD5>e8b200ac73edcaa4fe0c9eb3053bb872</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>f1c0c3e95786f23c688c486d118d21e457447aa2276ae407d51dacb2da24019e</SHA-256>
              <SHA-1>6a926a45bfc6ca618bdaf58e1516fd39b571e549</SHA-1>
              <MD5>1a26e08db36e24cd76e4aa74121c621c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\</registry>
              <origin>DOTNET_DECOMPILATION</origin>
            </value>
          </registry>
        </iocs>
        <name>AsyncClient.exe</name>
        <report_id>ac797d13-0048-4a85-90c8-1595db251aac</report_id>
        <tags>
          <value>peexe</value>
          <value>dotnet_pe</value>
          <value>config-extracted</value>
          <value>asyncrat</value>
          <value>quasarrat</value>
          <value>anti-vm</value>
          <value>fingerprint</value>
          <value>base64</value>
          <value>reconnaissance</value>
          <value>remoteaccesstool</value>
          <value>adaptive-context</value>
          <value>lolbin</value>
          <value>packed</value>
          <value>schtasks</value>
          <value>obfuscated</value>
          <value>vbnet</value>
          <value>installer-heuristic</value>
          <value>predictive-alin</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>37a95bb77001e30a94bd24dcf36b2bb09db6d3e86882a744dc3d3297aac45fda</id>
    <title>Analysis Report for 37a95bb77001e30a94bd24dcf36b2bb09db6d3e86882a744dc3d3297aac45fda</title>
    <updated>2026-08-20T22:27:05Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877f60f2677ae4d366d8bd</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6a877f38b107fd4d6e901aec</flow_id>
        <hash>37a95bb77001e30a94bd24dcf36b2bb09db6d3e86882a744dc3d3297aac45fda</hash>
        <iocs>
          <urls>
            <value>
              <url>https://fsf.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.gnu.org/licenses</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.gnu.org/licenses/why-not-lgpl.html</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://fsf.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.gnu.org/licenses</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.gnu.org/licenses/why-not-lgpl.html</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>fsf.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>gnu.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>fsf.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>gnu.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>209.51.188.116</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>209.51.188.174</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>95116bcf84583989ad8d09111ddf1a658cdb3a215bc866e304c7f825b1b6bf83</SHA-256>
              <SHA-1>ab3ec371b3cba26a16c825afbc28fbf78f403f76</SHA-1>
              <MD5>2ce24cf0c930b29034185481c2080d59</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>0a6e8714c521c29e3fc8c949873617b936f9a5c118977f643c1f631b0a198a15</SHA-256>
              <SHA-1>9802f9c53f08eeb4e412a13ee92a6c4467ea40c7</SHA-1>
              <MD5>652e1b19e07e3c737d0d17136f059045</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>1d8e98ff310698b529aa15e057b66f68fe7da8508359982ea8d1c506e272d4f0</SHA-256>
              <SHA-1>76c149df7889309858abe1d86480877285ff2a18</SHA-1>
              <MD5>a3d537d8ee5e95d55e7a4f7c1c3d9988</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>230184f60bae2feaf244f10a8bac053c8ff33a183bcc365b4d8b876d2b7f4809</SHA-256>
              <SHA-1>1eba7caf09a39110ad2f542e3ed8700d1a69c6d3</SHA-1>
              <MD5>e62637ea8a114355b985fd86c9ffbd6e</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>41771220004b9a5d7d23f5f448d521ae2e7155f472ec68f15e621c3f39c97e6d</SHA-256>
              <SHA-1>b011521425dfe5b4fd104cdc1f06eed698eaf1d8</SHA-1>
              <MD5>d90a9e9da6522bee179736e4599c978b</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>51e2c59ab5c60bdff349d321d5e7c11bf98de73c6582f1b04b451670feb8a43d</SHA-256>
              <SHA-1>ea4c945bcd8cef4ebb3dc373163dd84df51b27c0</SHA-1>
              <MD5>104f0a4243da5b3b7a668ffc053d8045</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>5556d5ab489c41de02ef8bf1bcff9804244664f4d1089674421ffd597bb3335c</SHA-256>
              <SHA-1>31a108aa76c91f4a3432e5f58d5b9f4980a2568e</SHA-1>
              <MD5>ba8e5703378aa949294cb8705a51b510</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>8d9ddc6efa53018db22de1e67d6d4152cbef07b8e8293a15eea271593b4ad1b4</SHA-256>
              <SHA-1>65890ffd4436fa281e919df990f02c0698ece7de</SHA-1>
              <MD5>39955afafad9ab83fd57f29e66da17e6</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>a3f6861cf91855f4727fe7e72fdc48b674edeb49cb380dee29dae8cbf0a02089</SHA-256>
              <SHA-1>f92b9353e50beff74fbf75b5479b1a5a247fe53e</SHA-1>
              <MD5>5a058b2ab69e7dcc19cae58ab82e1c76</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>e5ca40dd1675fab6942f39615d9ae5902a6155a89062bf503713c1289b8ec049</SHA-256>
              <SHA-1>98eed9ad5bdfb66e38c585192fc5b965e4578bd6</SHA-1>
              <MD5>35fc98e8261e449faf88a4931fd76632</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>e99e047a47c42f3c2686d407702d09da19d66d70a36985f847192234ba51f846</SHA-256>
              <SHA-1>4ff2a5dd4559aff616ea2ac668a418d604f92060</SHA-1>
              <MD5>6346f97f6a25fa139f3faa2fc84faeae</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>ae89b7b4f2d33baf1231e70d83428ef4efc0dabcc895d158e9bf1542f62e69cd</SHA-256>
              <SHA-1>da7b4caf02b7a20e8907957e7e7e4dcbaf857010</SHA-1>
              <MD5>387ba4c7ca1dc130c658b4f9faea8c72</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>cd4cff31560a04a3b504a0683b61ee6e01a3986698267590be9574671439822c</SHA-256>
              <SHA-1>f14fdc577c2f72955d5f9b22ba6de32ca9f72293</SHA-1>
              <MD5>c51fb08103320c4a609f063402bd4363</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>3bb784557128f31a2072fc84695f06c05229d544d20cb64fa51ccbc991c839dc</SHA-256>
              <SHA-1>4306d9eca28ca618ea516661a7485481d61dae68</SHA-1>
              <MD5>829f58c59a2ab3a644efd99ddf44096f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>Seralyth-Menu.dll</name>
        <report_id>7f5cec87-048d-438b-b140-65a40b3ecfa8</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>xml</value>
          <value>pedll</value>
          <value>dotnet_pe</value>
          <value>base64</value>
          <value>packed</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>b3938532fd45862e2683be7bfd9a7af6c238330c5b0c1b88470eef8840026644</id>
    <title>Analysis Report for b3938532fd45862e2683be7bfd9a7af6c238330c5b0c1b88470eef8840026644</title>
    <updated>2026-08-20T22:23:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877e75f2677ae4d366d893</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a877e53eeadd95beca17a59</flow_id>
        <hash>b3938532fd45862e2683be7bfd9a7af6c238330c5b0c1b88470eef8840026644</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>296b7d861a9ee473d4e8a62f9d7adb025d1fbe8e61206870f426e5c870a98936</SHA-256>
              <SHA-1>ed961a5852bd1ac5b55fa8fd70fa8213754abc57</SHA-1>
              <MD5>839f2e562a1f062fd873414ab28cf1d2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>692985cf029eb28098357336ea128b16211fb8fb8ab3e8f90949a952a2514f65</SHA-256>
              <SHA-1>10dd88f00a8f56cce48908628abe1215235f624a</SHA-1>
              <MD5>89647fd8d7ee80b9e9e46db2a1053a29</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>6a3c71d7f89e83280ff2aa75c76d49c3239060f8ee53cfc2692e05c4fc9c7eab</SHA-256>
              <SHA-1>c0170ce1c06de46e62508e1d774d64e952cd111a</SHA-1>
              <MD5>b62b6b1e4cd3054ab1b07b033356d108</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>7aa854f2b6bf3241c666d0b851ecaea27082934a4b2fa43db752591dfcf9434e</SHA-256>
              <SHA-1>5168d394292dd31902f3f8112b22cd604529f378</SHA-1>
              <MD5>2165d3c35627dfb0f24dfa8839b650c1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>9797167b129904f7aec7de33fb87b705188e9b8336eb605612f8aa507d9c7d2d</SHA-256>
              <SHA-1>24afa26f97d1a8fcae432de73e4bea4ca145d1f2</SHA-1>
              <MD5>cb25494f01be7126a9257ee5c847e2e1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>af380b7f1f6bedba49ef3833569a36314f9834b759bfbdc7f5474d65081186c6</SHA-256>
              <SHA-1>28a0948d37b93bfd392044a4338968bd3f4de535</SHA-1>
              <MD5>e71ed01bef9a6e44b5a60f28e2d14320</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>19c8ce1af431da18daf71572f6baefac</btc_wallet>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>UnityPlayer.dll</name>
        <report_id>ee1d5d5c-8b3e-48be-a33e-ee19096bc915</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>anti-vm</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>keylogger</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d76a10949f61003088a2f5d5776cefc50bd1bb86a803e8d914795e51bd4c30d8</id>
    <title>Analysis Report for d76a10949f61003088a2f5d5776cefc50bd1bb86a803e8d914795e51bd4c30d8</title>
    <updated>2026-08-20T22:22:18Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877e3af2677ae4d366d888</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a877e195a70bef4cd152621</flow_id>
        <hash>d76a10949f61003088a2f5d5776cefc50bd1bb86a803e8d914795e51bd4c30d8</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>12faada3a7d86ee8a3acc0cca41fef874037737f15784dfec42205a24e1be529</SHA-256>
              <SHA-1>8cb8da9dbb86183961b66aea5e63f9df094e2714</SHA-1>
              <MD5>5f213072c2c805c4e99cbccd26afc2a2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>140bc93cc2736301d6644a15f0164c0135f032a3a00f327af6f30aff4878f57b</SHA-256>
              <SHA-1>55c7dee5497720d9978231a98ae8658148da390b</SHA-1>
              <MD5>0c9d48e635f6ef6f4ca06905ec8d5a99</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>1cdb3fe23d634ceee5a00e59a5ae5428abd295ff6115d051afd47179b791154c</SHA-256>
              <SHA-1>8edcdfa765fea783da91395350829a8742b9da89</SHA-1>
              <MD5>7dd644e392d6fd94485e34bae5a54ffa</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>241e629f54d71ead85e0fab3ae41c2110e6dc175372c36a9039409a8140e55f9</SHA-256>
              <SHA-1>82d6373544f973082af2e4645fe22b15e4e659b3</SHA-1>
              <MD5>2ceef834cceb4c9f816b9fc3f944788e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>25850fa5ac6fb636d329e408bc84f1b01f771b6b7517c49219e5353de91154de</SHA-256>
              <SHA-1>cdb4c24b5a9ddb1d13031bac6d57c74a11393cb7</SHA-1>
              <MD5>4f97ec23526dc1cd841bbc516cc3e099</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>3257b105cc92b02ba7f276274be480ba30f32dcf4f845ec2fa01c1ac826f8a7a</SHA-256>
              <SHA-1>efbb974ac9544d74f963120ec27bf71c811f10f6</SHA-1>
              <MD5>d1f3f9d60e22bc8c9a21115112d6e54c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>32677faa59e9e11aed01837e6b9b6b206040903f602cb2f11725e19181f46a8d</SHA-256>
              <SHA-1>9838b7027ea7c212ad06869ab1f6978aca829196</SHA-1>
              <MD5>acc936e47c33a53b290ab2438a2e070f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>3902e6807d424a940fdc4bd217d100a0ca9f43c993f940335db3a45747b87bbb</SHA-256>
              <SHA-1>339909a5c4c0990b413f0529e7efc4dfc447a52e</SHA-1>
              <MD5>9a4beb926eee0c6db99e8e8e14996dc9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>3d29ad62f05d9603e6d67715e0fbe70b75f4ee6ca39aa9f9defcc1809bb99bda</SHA-256>
              <SHA-1>65a8fab7f8390bb5d6d59dfd7480fe7616ef7e1f</SHA-1>
              <MD5>12840664c5a4718093319c424ce51e5d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>4b27bc68ed2e1948cd047a7628f38e1a90afba1bba3a4fed165b85618a18c2de</SHA-256>
              <SHA-1>c130ffada563c210ca322a9c8ac1a0931885334d</SHA-1>
              <MD5>f7dd754594b72d5654923153968276e6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>5819eceb7647143f2d0c9fa441caae4f9c2adda5f57e2944b8b1aff4a89bf1e5</SHA-256>
              <SHA-1>b3090b3862584ac07059ade4ef29c0b8879326bf</SHA-1>
              <MD5>1bca825db4a1a5b5c488e84f10e7f41c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>6284976a046fa3c0fc984f37f987d4a175e4cdb01724bb343131d99f540409ec</SHA-256>
              <SHA-1>81d7a348b07fbb43e23afae2ffa47ae63e728354</SHA-1>
              <MD5>342ab16bf7866b9ebd9558a82657fce1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>835fbaa26b5ae2aafdd3e256274813f2b98df73adb067013c285e5d912e82ad5</SHA-256>
              <SHA-1>ce6f83e72776ac36bcaf56674ee1a5b0dd4838b2</SHA-1>
              <MD5>154a7f72a07fb1d33d116b54b8a8507a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>85563d55f8a6a78bd3adfd7b2071c6099df61a590d21cc17c5007f3420adf300</SHA-256>
              <SHA-1>5eec0042a4de89c09483dbf014702882f8ee7555</SHA-1>
              <MD5>a64ec800f88d03861d5f18b0f5b41518</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>8e07b09dc889c0cfe4f3683df4c01a714d5aae1f638d6a93450ce867a71c7a69</SHA-256>
              <SHA-1>c43967f7deaac4f81be90b1f8ad1b19aa913706e</SHA-1>
              <MD5>bc6f7e681401aad7e342785d0159cebd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>96a3eab080e85d5fbc723c5cfc4fc32aee5cde3461d4e67ccfe8d3d49a9ef089</SHA-256>
              <SHA-1>acfee9e0dc266831c1746e1956d0b2191f9c812a</SHA-1>
              <MD5>7ee7637ced015612cc7ee419484c42cf</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>9b0d3f3ec8760d964bf271a826cb67d08ca1f48cacedbb52b6919a5e9de3a1d7</SHA-256>
              <SHA-1>0552aaff43e63c9517f30c06bb38977692c23525</SHA-1>
              <MD5>ba3036f9503a630d7e5b1cbf536f3d3c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>9d4a3ac515e9e26dec126a8e46f0615376564cacef98942d4a8ff1ef14e2f677</SHA-256>
              <SHA-1>90f8c1bdb73b655d5c050a8ab37c012fd9bc781f</SHA-1>
              <MD5>13a5d6c9d0ca0e5992d37f2740962a53</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>c010c77197370976a77b6a108b3dc1ecb00267363946393a9be8df92a85fbe7f</SHA-256>
              <SHA-1>31381d8c8abd49525cff44fb2391e49ed6a2ea02</SHA-1>
              <MD5>dd76d8e429eb85b4cc9ff48cee125b58</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>fc7eabf8db026eb70e116ea166326cc0f4752cade05a20222c1c8609b7743c22</SHA-256>
              <SHA-1>738431dc77d68c0afa96c98b43d915072f058bba</SHA-1>
              <MD5>5334d779eb7efa1e1d7995a20ed733d6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>1f261fee823658b55a83e51daf2987fb</btc_wallet>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>UnityCrashHandler64.exe</name>
        <report_id>a620273b-aa87-4666-8914-6cc81fb51720</report_id>
        <tags>
          <value>peexe</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>424dc6d3e9872c0cc83907a589082a0d96e89f9485f1fef980dbbbaadc7eac70</id>
    <title>Analysis Report for 424dc6d3e9872c0cc83907a589082a0d96e89f9485f1fef980dbbbaadc7eac70</title>
    <updated>2026-08-20T22:20:36Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877dfdf2677ae4d366d87a</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a877db2eeadd95beca17915</flow_id>
        <hash>424dc6d3e9872c0cc83907a589082a0d96e89f9485f1fef980dbbbaadc7eac70</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schemas.microsoft.com/SMI/2005/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/SMI/2016/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>0b285673bf432004b536f37212ebc737fc5eb3e70a34f0560a5b2145efcfadb8</SHA-256>
              <SHA-1>d7fd7174fdda1750eb1376520ffa8c1b6c1b4721</SHA-1>
              <MD5>4bc8a2c8c7b415b270b9646a23f94f13</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>1193556754f704a2aab92a684dc67d40ff3e60772e2f410e1a62844e5a4fe811</SHA-256>
              <SHA-1>66f9b09558acd2c3605a2eec9c6eb0720de40124</SHA-1>
              <MD5>714c0bb3e5c53ecdcaa2b9f70753d810</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>26d7173b92d54b71d24b6dcaec4c86d2e9a58d3262c364d942b3e982bf8c0a4c</SHA-256>
              <SHA-1>0e37f8b23bb358f76c4aee5dacbdb6241e3bdd3b</SHA-1>
              <MD5>8863447ec3cc685adbeb7fb54b961773</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>2a87b1f32c5d0435090c72c392b75394f706e5750eff64fd85d25e1c622ee581</SHA-256>
              <SHA-1>52ca961fd37ad960905a681d1db5157508ef1602</SHA-1>
              <MD5>3bf2dac037ce87794e66ff7f054e913f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>2b54815853bf5a863ef4eeb584b4c8871f0015ccd66c2077008618a05172e02b</SHA-256>
              <SHA-1>087072969be2e3342f77741ca2092fdb0233d1f8</SHA-1>
              <MD5>37e5693364de3a0020a3061afef3ecc3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>2ee5f53d05911814948cad58e78254ed122d21183892f25782ff4e6502454fda</SHA-256>
              <SHA-1>7ea0ed44cf9a2a409dfb6440f459383439dd760a</SHA-1>
              <MD5>0a51774f23f54391f365a670fc98a4a0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>4c88f06ac1a07062bd071b6f34eafb8e4ce1eeb3e3c908342e5d011a96039142</SHA-256>
              <SHA-1>4c32e582d7cf29108b136eb4448bbb7b5c605068</SHA-1>
              <MD5>375d2e0d215edbf8e76254a6058946dc</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>6c45cc6e53843ca94e63872787c4e0da68e72cf4a15ce7b19643c4f6984d0953</SHA-256>
              <SHA-1>210efdd649a322a6d2dc2aac74d59023a12201ef</SHA-1>
              <MD5>4f8f84bbe32a45773cb4800dca4d3476</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>6ccb60e633d3201f40f37552ad214c04c808a26ddf2c0046759107c347937dba</SHA-256>
              <SHA-1>f81880ade41949dacfadc8fb7b752b747259a385</SHA-1>
              <MD5>f090c6acd0462cc38e4afb40f05854ad</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>7e85c3d2a81acd4958c851395f3582d503e4b2b745613570ef11f5ea4cc14033</SHA-256>
              <SHA-1>a3b557bd9a6b2486cd69cb9b0410932099824e47</SHA-1>
              <MD5>ed76989955732b5e34e25832614471f5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>91f1387c40f4ec49b5dc7b6756049dc1e1eb629470b174589f8915acc7906b7b</SHA-256>
              <SHA-1>1b9048aa6406aea4768956585489228a32d517b1</SHA-1>
              <MD5>220e15d63a1548b8731e9138ae0ea317</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>937b2345f09922f03db42dceea48bc962a79b0bcd025565968e219573f9041f6</SHA-256>
              <SHA-1>6b0f0725450d374494e645de9d2ac806b1c6ec8e</SHA-1>
              <MD5>6acb84907fd9aa988fea31b8e5e2db6f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>988eecdf4e3b85c5295c8c72f15987a49df4b15b52ee3630aee5596e57c4a1e5</SHA-256>
              <SHA-1>91e44fd9903e5a5a9c108fb999e906a5ec50b1f5</SHA-1>
              <MD5>3a1e143852046b86f788d52f80833aef</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>a0cda88d726f53cb9463ce701dfa13dcc7990c750ac0510e6402f254746dba8b</SHA-256>
              <SHA-1>3c5e2b8714f78ea6ff4afbe3b631201ff23e1f1f</SHA-1>
              <MD5>4cd67b384dc0b6b9f56d172d735d1589</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>ac105cf102de0e23651de1cad5061d8d662743011d14d23664c80f371b4f5429</SHA-256>
              <SHA-1>e1ebe679ee87e12bd28f4c65444007f736e6766f</SHA-1>
              <MD5>17070beeeec04d1dba40ec576a532b24</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>b6595b53bae6fceaf2795f9cee4317a9d1f4dccb6512ea012ce2f2bc70bbf2e0</SHA-256>
              <SHA-1>7edd3f95aec3791307bcaa4ccf068cdd2c8d1dc7</SHA-1>
              <MD5>ce81a78444bdfbb58b9a674e42b056fd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>c7d2cb0f3b07b8f87676f985325b4f42d86e2a83e24dd2f5c0040d17791c035d</SHA-256>
              <SHA-1>55ae9a187bd16b4eb3afba7adeef5647e5e414fa</SHA-1>
              <MD5>b77add527da299ee5038408c3fe1d0bf</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>cf7c8ebcad18cae042bc1ef0d6275f164b12e78800edcb34c233f47a5aac6cd5</SHA-256>
              <SHA-1>ba7681783bd618b3d246274eee60122e96be744b</SHA-1>
              <MD5>0a31070566f9c584270fd452cd0d18d5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>f67ab7d6091a4157b8ce497397850e312bca84f95854c79670002d3ad52acc5f</SHA-256>
              <SHA-1>f7b4cbd90786c131bb9535c7652dab5cba9f5a47</SHA-1>
              <MD5>2e297d3deb4230829999d9d276de211f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>BunnyHero.exe</name>
        <report_id>29059312-f900-4aa0-ac8a-eea5e13e1319</report_id>
        <tags>
          <value>peexe</value>
          <value>microsoft_visual_cc</value>
          <value>anti-debug</value>
          <value>anti-vm</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a2f7560ec111e2510d5fa44c62fde0b5d1cb3ecd16a0fb32ff7cc54deb026efa</id>
    <title>Analysis Report for a2f7560ec111e2510d5fa44c62fde0b5d1cb3ecd16a0fb32ff7cc54deb026efa</title>
    <updated>2026-08-20T22:19:41Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877dbff2677ae4d366d865</_id>
        <file_type>application/octet-stream</file_type>
        <flow_id>6a877d79eeadd95beca17896</flow_id>
        <hash>a2f7560ec111e2510d5fa44c62fde0b5d1cb3ecd16a0fb32ff7cc54deb026efa</hash>
        <iocs/>
        <name>Touchup.dat</name>
        <report_id>8fad0885-ec98-4f28-9c93-cc65317e389d</report_id>
        <tags>
          <value>data</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>198cd1f48fe6924f4c09582805c7dcf6b3d320b5809c50c5a47c3c2b221a3acc</id>
    <title>Analysis Report for 198cd1f48fe6924f4c09582805c7dcf6b3d320b5809c50c5a47c3c2b221a3acc</title>
    <updated>2026-08-20T22:19:41Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877ddbf2677ae4d366d86f</_id>
        <file_type>text/plain</file_type>
        <flow_id>6a877d79eeadd95beca17896</flow_id>
        <hash>198cd1f48fe6924f4c09582805c7dcf6b3d320b5809c50c5a47c3c2b221a3acc</hash>
        <iocs>
          <registry>
            <value>
              <registry>SOFTWARE\Maxis\The Sims 4\DLCs\The Sims 4 SP81</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\Maxis\The Sims 4\DLCs\The Sims 4 SP81</registry>
              <origin>CONTENT_PARSE</origin>
            </value>
          </registry>
        </iocs>
        <name>installScript.vdf</name>
        <report_id>81f10bbc-f2f6-471a-a1f4-75f1f57eba21</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>2ac415f38c11186706a2142b8fd8a32065c0e2a9b584c059fc5e3bc96db94505</id>
    <title>Analysis Report for 2ac415f38c11186706a2142b8fd8a32065c0e2a9b584c059fc5e3bc96db94505</title>
    <updated>2026-08-20T22:19:41Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877de1f2677ae4d366d872</_id>
        <file_type>text/csv</file_type>
        <flow_id>6a877d79eeadd95beca17896</flow_id>
        <hash>2ac415f38c11186706a2142b8fd8a32065c0e2a9b584c059fc5e3bc96db94505</hash>
        <iocs/>
        <name>mnfst.txt</name>
        <report_id>19314d23-3387-49b5-adc6-136f1bbd8bea</report_id>
        <tags>
          <value>csv</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>c3d84af090991fcf380c9ab0ff29b415306bce6251f6c10fbe8aa066981b424e</id>
    <title>Analysis Report for c3d84af090991fcf380c9ab0ff29b415306bce6251f6c10fbe8aa066981b424e</title>
    <updated>2026-08-20T22:19:41Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877d84f2677ae4d366d857</_id>
        <file_type>application/xml</file_type>
        <flow_id>6a877d79eeadd95beca17896</flow_id>
        <hash>c3d84af090991fcf380c9ab0ff29b415306bce6251f6c10fbe8aa066981b424e</hash>
        <iocs/>
        <name>installerdata.xml</name>
        <report_id>0f62abbb-324e-4a4d-bd40-ae8db1386b40</report_id>
        <tags>
          <value>xml</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>eea0d489713b1ddc267c24b14b47ed09d7baf5c1a118a110670848b05eeb4984</id>
    <title>Analysis Report for eea0d489713b1ddc267c24b14b47ed09d7baf5c1a118a110670848b05eeb4984</title>
    <updated>2026-08-20T22:19:41Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877dbdf2677ae4d366d863</_id>
        <file_type>application/octet-stream</file_type>
        <flow_id>6a877d79eeadd95beca17896</flow_id>
        <hash>eea0d489713b1ddc267c24b14b47ed09d7baf5c1a118a110670848b05eeb4984</hash>
        <iocs/>
        <name>Cleanup.dat</name>
        <report_id>0994d727-81b6-43a1-b0b5-dbae179447d5</report_id>
        <tags>
          <value>data</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a712c0ae6e306d1de1c1b5133255223dc21a0fc30d0e4416d91f88d852397c2f</id>
    <title>Analysis Report for a712c0ae6e306d1de1c1b5133255223dc21a0fc30d0e4416d91f88d852397c2f</title>
    <updated>2026-08-20T22:19:41Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877dc8f2677ae4d366d869</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a877d79eeadd95beca17896</flow_id>
        <hash>a712c0ae6e306d1de1c1b5133255223dc21a0fc30d0e4416d91f88d852397c2f</hash>
        <iocs>
          <urls>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedRootG4.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://s.symcb.com/universal-root.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.digicert.com/CPS0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://d.symcb.com/cps0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://d.symcb.com/rpa0.</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://d.symcb.com/rpa0@</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cacerts.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl3.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl4.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>d.symcb.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>s.symcb.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>ts-aia.ws.symantec.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>ts-crl.ws.symantec.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>45.60.121.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.66.2.5</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.11.40.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>162.159.142.9</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>13.56.82.130</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>08817ac6dfc51168826d825c9291bf8854cc4c134af2b59307de102c67478346</SHA-256>
              <SHA-1>d951ee916ade15ed2e46c89b6e6329bcc3d726dd</SHA-1>
              <MD5>bea15e8adfd395b0565072b523e6c151</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>0a7a9d253b4c745124ccdeacade6ef5d5ed62b2281eec56d4b7155894f53e738</SHA-256>
              <SHA-1>caead65034122dd699c99d443ea5421a09a8f464</SHA-1>
              <MD5>d34b21cbaa7d0820d88529923346edbd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>0bdf9bb3eeb18cceba50f43b9ee301260f555284f96ef823a9b80e3f5458da4b</SHA-256>
              <SHA-1>fec973505692f8d45e03e095af20364a0b3bcd1c</SHA-1>
              <MD5>a804a88ea4d267b87320a148f99f7c4e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>0cd5dd8ee5cfc041df17546588510c4541f23bc7c53d316cf31340834e5b8640</SHA-256>
              <SHA-1>1b649222d6d1a4dc12fdabc1006683e8c73f5a11</SHA-1>
              <MD5>6eefe7e9c043570adadc7d2cdef5697f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>1741966b679cbb7180e87a3ce402e981295bfb01d75827953813b2c9c43fd223</SHA-256>
              <SHA-1>3dec2c88390ea04b23e9aa24729f89440fa88a0a</SHA-1>
              <MD5>c0768136b03d97ff19fdc1c703eb37c7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>37fe8dd94365739717e97d3eb504ac2d9e960c3a87574d61e8fe638391d99e15</SHA-256>
              <SHA-1>b8600ed323b9d90610c28c8090645267b5926d37</SHA-1>
              <MD5>ecf4ecbcb4a810b54180cf65d663ed74</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>41cac24e99dbedbd17a71615e4c3281861d5eff1cfb9624f81ffcfb19822260c</SHA-256>
              <SHA-1>83786b4d8b74ee1dbd27e09bd60066bbac9257a3</SHA-1>
              <MD5>ab1fd929e71deda498bebab7e4438035</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>5122641cb4adf8b37d6a1ca522cb17f8b32769c023835476e141544d20c03fbe</SHA-256>
              <SHA-1>87cb27f9058ad82f9fca4fce1876cc49707c081a</SHA-1>
              <MD5>beab2dda2411632c98e7bd302ba7a903</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>5b91f4e1e8a68d44c800f0cbfc71bb2dfc2cd27ff0cb50bc767ebbb33ae0ac74</SHA-256>
              <SHA-1>60bf210c9a4bc28e263d5b8afd690ffdc3fc77ac</SHA-1>
              <MD5>4645d5f29bd8b74811e54065f89863c0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>66f1a838910f6f8197fa21aa6764fb55bd4e8ddd9086cbb7e741026fb9796f50</SHA-256>
              <SHA-1>aa9ee39dd7c7501d2bc5246189754a267ffe7b81</SHA-1>
              <MD5>f75765398cd558b75c4e6378da345a51</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>749bdafff3ed075f3b53b7752582fa00981f43dec267396eae59a233fca62007</SHA-256>
              <SHA-1>a3df70039b7ad26f64ae80cefdbb1f03fef5cdb6</SHA-1>
              <MD5>f240ccfe088994403f47d8089a5b71f3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>7733a4cb58665b0e7385c18d980c0dd8ac54532b896146f1762f027a7d7005a3</SHA-256>
              <SHA-1>5a4812ea23cbdba3a94a7d76316f6d5e491ac51b</SHA-1>
              <MD5>568f3b03f121c74125827a542d20868f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>832cb25200f2f1c36713b52225fd852f3d95c3cadb0578f2fcc5aa2dc5b94690</SHA-256>
              <SHA-1>7c8a379e5fb66ce2550e9170c3d25f4c079299f4</SHA-1>
              <MD5>9d901429c89e70efc6dfcf6eb1e9ff6e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>bbcb0b44c76363af2fb87ff81996d894246bcc303246a8c8a32c9406be1e6ee0</SHA-256>
              <SHA-1>8ac400b949355a8f877f9a20964c0d2c1d72ff6b</SHA-1>
              <MD5>da06dc583a6a069ed8d17f3767109176</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>d2a2276e1356d3e320676c1d5511c6a5e5c89a0182ec710778e5f9ba5c41a33d</SHA-256>
              <SHA-1>9d2a20786be850d51a7463cbff937471adc1ab8e</SHA-1>
              <MD5>978b5e1649a678713d0352b616e2617d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>f04264d4863375272db4846205da88c83da662101dfd947851f1747225028769</SHA-256>
              <SHA-1>97dca765d31c45476d22037d1cbbc001830b12ab</SHA-1>
              <MD5>b6c3c1513bf266768743b0a517d63f0a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e</SHA-256>
              <SHA-1>80c9820ff2efe8aa3d361df7011ae6eee35ec4f0</SHA-1>
              <MD5>4842e206e4cfff2954901467ad54169e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/octet-stream</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>8a58eec01bb66ff8abe1016e213b9959b71aa47abffe90fc3efeb0452d371dbd</SHA-256>
              <SHA-1>225bdeeb85cf767b536e07fe6cc7fad5070be7ae</SHA-1>
              <MD5>346e3a756c4c5e5ec35ade5bf36c9e19</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>000214A0-0000-0000-C000-000000000046</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>Cleanup.exe</name>
        <report_id>bcb73525-9c6b-46aa-8611-483fdebf7e18</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>data</value>
          <value>keylogger</value>
          <value>anti-debug</value>
          <value>cmd</value>
          <value>evasive</value>
          <value>lolbin</value>
          <value>msiexec</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>captcha</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>95c13474893e2cb67194c3089aa96dab6f8e3e960c652e5f331182ed7fa1e924</id>
    <title>Analysis Report for 95c13474893e2cb67194c3089aa96dab6f8e3e960c652e5f331182ed7fa1e924</title>
    <updated>2026-08-20T22:19:41Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877deaf2677ae4d366d875</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a877d79eeadd95beca17896</flow_id>
        <hash>95c13474893e2cb67194c3089aa96dab6f8e3e960c652e5f331182ed7fa1e924</hash>
        <iocs>
          <urls>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedRootG4.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://s.symcb.com/universal-root.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.digicert.com/CPS0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://d.symcb.com/cps0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://d.symcb.com/rpa0.</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cacerts.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl3.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl4.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>d.symcb.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>s.symcb.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>23.11.40.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>45.60.131.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>13.56.82.130</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>0a7a9d253b4c745124ccdeacade6ef5d5ed62b2281eec56d4b7155894f53e738</SHA-256>
              <SHA-1>caead65034122dd699c99d443ea5421a09a8f464</SHA-1>
              <MD5>d34b21cbaa7d0820d88529923346edbd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>0bdf9bb3eeb18cceba50f43b9ee301260f555284f96ef823a9b80e3f5458da4b</SHA-256>
              <SHA-1>fec973505692f8d45e03e095af20364a0b3bcd1c</SHA-1>
              <MD5>a804a88ea4d267b87320a148f99f7c4e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>1741966b679cbb7180e87a3ce402e981295bfb01d75827953813b2c9c43fd223</SHA-256>
              <SHA-1>3dec2c88390ea04b23e9aa24729f89440fa88a0a</SHA-1>
              <MD5>c0768136b03d97ff19fdc1c703eb37c7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>37fe8dd94365739717e97d3eb504ac2d9e960c3a87574d61e8fe638391d99e15</SHA-256>
              <SHA-1>b8600ed323b9d90610c28c8090645267b5926d37</SHA-1>
              <MD5>ecf4ecbcb4a810b54180cf65d663ed74</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>41cac24e99dbedbd17a71615e4c3281861d5eff1cfb9624f81ffcfb19822260c</SHA-256>
              <SHA-1>83786b4d8b74ee1dbd27e09bd60066bbac9257a3</SHA-1>
              <MD5>ab1fd929e71deda498bebab7e4438035</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>5122641cb4adf8b37d6a1ca522cb17f8b32769c023835476e141544d20c03fbe</SHA-256>
              <SHA-1>87cb27f9058ad82f9fca4fce1876cc49707c081a</SHA-1>
              <MD5>beab2dda2411632c98e7bd302ba7a903</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>5b91f4e1e8a68d44c800f0cbfc71bb2dfc2cd27ff0cb50bc767ebbb33ae0ac74</SHA-256>
              <SHA-1>60bf210c9a4bc28e263d5b8afd690ffdc3fc77ac</SHA-1>
              <MD5>4645d5f29bd8b74811e54065f89863c0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>749bdafff3ed075f3b53b7752582fa00981f43dec267396eae59a233fca62007</SHA-256>
              <SHA-1>a3df70039b7ad26f64ae80cefdbb1f03fef5cdb6</SHA-1>
              <MD5>f240ccfe088994403f47d8089a5b71f3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>7733a4cb58665b0e7385c18d980c0dd8ac54532b896146f1762f027a7d7005a3</SHA-256>
              <SHA-1>5a4812ea23cbdba3a94a7d76316f6d5e491ac51b</SHA-1>
              <MD5>568f3b03f121c74125827a542d20868f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>830123c4af5fcd81b4b697be2d89e6c459037505933ed0e24bec901091c1ed04</SHA-256>
              <SHA-1>dc67a0d1ee969ea9922b9c600a75bfd822413547</SHA-1>
              <MD5>1261107a52f905d7c2edd3c87f60ff06</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>832cb25200f2f1c36713b52225fd852f3d95c3cadb0578f2fcc5aa2dc5b94690</SHA-256>
              <SHA-1>7c8a379e5fb66ce2550e9170c3d25f4c079299f4</SHA-1>
              <MD5>9d901429c89e70efc6dfcf6eb1e9ff6e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>975fc7d4710709fdd8c36f5ffeab641a1d3781074f135bed3c0687f332e07ad1</SHA-256>
              <SHA-1>6bdf3247dae4dc009df3f7a9870aab86f649c8e1</SHA-1>
              <MD5>6581c8dcdfbc8db878f4609edb350a8f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>ad55339dedd243b4a8ba1043e12e73bd7d03f6e9046a034814e846fca0d3e928</SHA-256>
              <SHA-1>db403eceac93ea30b6f3f63963473b8796160821</SHA-1>
              <MD5>13625db75b533f7f1ddffa394a4a3460</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>bbcb0b44c76363af2fb87ff81996d894246bcc303246a8c8a32c9406be1e6ee0</SHA-256>
              <SHA-1>8ac400b949355a8f877f9a20964c0d2c1d72ff6b</SHA-1>
              <MD5>da06dc583a6a069ed8d17f3767109176</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>d2a2276e1356d3e320676c1d5511c6a5e5c89a0182ec710778e5f9ba5c41a33d</SHA-256>
              <SHA-1>9d2a20786be850d51a7463cbff937471adc1ab8e</SHA-1>
              <MD5>978b5e1649a678713d0352b616e2617d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>f04264d4863375272db4846205da88c83da662101dfd947851f1747225028769</SHA-256>
              <SHA-1>97dca765d31c45476d22037d1cbbc001830b12ab</SHA-1>
              <MD5>b6c3c1513bf266768743b0a517d63f0a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e</SHA-256>
              <SHA-1>80c9820ff2efe8aa3d361df7011ae6eee35ec4f0</SHA-1>
              <MD5>4842e206e4cfff2954901467ad54169e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/octet-stream</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>913bf321f37ba297336670fe8ec7b755cfa39f959fc792d2166c6eb5a02d6cfb</SHA-256>
              <SHA-1>cd693211726f82a9727629202be4c4004652e1d4</SHA-1>
              <MD5>37ab65e31a4c610bf0a3a076d0ea2e19</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>b9ce148560bc70425a4bdd5e1631c851f4fea72c5a701ddf8aa67590081e7d9f</SHA-256>
              <SHA-1>d57a1d6a5af41e0dacec63ea6ed3eb0787664dda</SHA-1>
              <MD5>8046f9592eb94c571a0c4e082c10092d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>000214A0-0000-0000-C000-000000000046</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>Touchup.exe</name>
        <report_id>a4ade0d0-f625-4557-b299-709d3dde3d6e</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>data</value>
          <value>anti-vm</value>
          <value>keylogger</value>
          <value>anti-debug</value>
          <value>cmd</value>
          <value>evasive</value>
          <value>lolbin</value>
          <value>msiexec</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>captcha</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>68c340708946f6f1f6c60f6dcfb5c4e209499248f3d042e3e8fefdd5892b518d</id>
    <title>Analysis Report for 68c340708946f6f1f6c60f6dcfb5c4e209499248f3d042e3e8fefdd5892b518d</title>
    <updated>2026-08-20T22:19:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877d82f2677ae4d366d855</_id>
        <file_type>text/x-ini</file_type>
        <flow_id>6a877d62009ae7a1a8d2f2da</flow_id>
        <hash>68c340708946f6f1f6c60f6dcfb5c4e209499248f3d042e3e8fefdd5892b518d</hash>
        <iocs>
          <urls>
            <value>
              <url>https://notaemitida.dynv6.net:443/dav</url>
              <origin>UNC_PATH</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>notaemitida.dynv6.net</url>
              <origin>UNC_PATH</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>185.223.252.219</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>931fa78c494f04ae269a0b8290bd752f5a868a1b5eaa6f7b7355377da1f17889</SHA-256>
              <SHA-1>fdc482ac33de5a589d2b76edda43a89c81210958</SHA-1>
              <MD5>e1b0d945a4e1304c3f158d8d31dc3c45</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <eth_wallets>
            <value>
              <eth_wallet>0x0:$url_explicit: [InternetShortcut]</eth_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <eth_wallet>0x15:$file: URL=</eth_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <eth_wallet>0x69:$icon: IconFile=</eth_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </eth_wallets>
        </iocs>
        <name>NotaFiscal_Emissao.url</name>
        <report_id>4d6cbe49-e013-49a9-9a0d-0f4017104eca</report_id>
        <tags>
          <value>txt</value>
          <value>html</value>
          <value>ini</value>
          <value>webdav</value>
          <value>opendir</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>b1920f04183cf11318202565908b0b3af54be864ff240ed8b24fea7afb9c2182</id>
    <title>Analysis Report for b1920f04183cf11318202565908b0b3af54be864ff240ed8b24fea7afb9c2182</title>
    <updated>2026-08-20T22:18:02Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877d5af2677ae4d366d84c</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a877d18eeadd95beca177c8</flow_id>
        <hash>b1920f04183cf11318202565908b0b3af54be864ff240ed8b24fea7afb9c2182</hash>
        <iocs>
          <urls>
            <value>
              <url>http://crl.globalsign.com/gs/gstimestampingg2.crl0T</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl.globalsign.net/root.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://secure.globalsign.com/cacert/gstimestampingg2.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://sectigo.com/CPS0C</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.globalsign.com/repository/0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.globalsign.com/repository/03</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>crl.globalsign.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crl.globalsign.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crl.sectigo.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crl.usertrust.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crt.sectigo.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crt.usertrust.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>globalsign.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>sectigo.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>secure.globalsign.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.18.38.233</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.64.149.23</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.21.226</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>146.75.122.133</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.20.226</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>91.199.212.90</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>16cdd58ca1278e38e0b7c2e687d211f5d101b207cea1d4c5bcbec5830cb1d97f</SHA-256>
              <SHA-1>e54992734af76e5a44ffdbb67828fd4bb30352f1</SHA-1>
              <MD5>180adfa270a9f4672ceb414ff50efffa</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>16de25c46a583b14f5219c8bb8c93a34189968cff2608349b69433283fd09782</SHA-256>
              <SHA-1>25421c18520f00d858f0f7195b77a3142c44cd3d</SHA-1>
              <MD5>3f3c73b2f6ea002bdfb08b82c6fd1f46</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>4984a23d62a81ee33096c6cb49e0641c7200212b5dc6c4c643033e4337bf313f</SHA-256>
              <SHA-1>bde04ca539c7c849015d0463e26fcbb3442551c0</SHA-1>
              <MD5>5748e4239bb2596d9c0aea869c47f1b6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>7afa64c487ea5e6cfac7d88ecd3305225bbc017ea62e6fe5d6313ef1bf12d9ca</SHA-256>
              <SHA-1>6934c4e948e0b0b0ea438c345481ae7e31053775</SHA-1>
              <MD5>27e79972ce41ae715a7eb13c245bc52c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>890e86b0d93c7298e45b24d599d04acca1730c6624785efacf5203db7b0a49a2</SHA-256>
              <SHA-1>78422667dd8bbbeea1d627d558926b04d9afef41</SHA-1>
              <MD5>3f32418ae28f25fe272e04a01ad14edc</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>8f4cd69b86772e7fc8b949693010f87dffb05fc14ab1601aa8095714f296c6cc</SHA-256>
              <SHA-1>a8a87e553ac98caf752e78a1c9d72f7cbe0aa167</SHA-1>
              <MD5>d0ee6e2ecfd566df09eb6bf433a4e81e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>aa776cd8b1c3c954b467eba4bed9b6594666cc6e7b72cc9108d8a5b08908a6d6</SHA-256>
              <SHA-1>f88c95cba9b9ffba0d6d5d00703e22d57b7a85fd</SHA-1>
              <MD5>aa900feb571a895c267c5f1515edf873</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>b886c9c747fa8bd78200ef516499c18d2179cd9f69ebae910deeffa8d01a059f</SHA-256>
              <SHA-1>bbcc3eb9dbe61beb53d0ed3c81663b16be493a1e</SHA-1>
              <MD5>f0fb8a3c47db0c75f97e7ee0b8be6aad</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>eb42de55803768834bc550fc865d1bf5170a25e2660ef52db0233d65bee45942</SHA-256>
              <SHA-1>77e0e2a9a0d74f9f045a77d0fa8f275c89be5b54</SHA-1>
              <MD5>6f19d52079c19b8e64b55db08455ab3a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>f7333d83f8d200c00cea59094eeba1acde9f9d28d30aca930b04deb8e06af62b</SHA-256>
              <SHA-1>d2bceb8474d0640d99203ec7e8874d67d13fe17d</SHA-1>
              <MD5>bcbd261ff78c3af12b8a87ee33a2a00f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>fa72339604a1d26e533c3f0acaa5e5b782b1c370a096134890b3cde0a6239930</SHA-256>
              <SHA-1>d6ee06d57302d50367a35a5e98243eea01683772</SHA-1>
              <MD5>512c74b9c4310c51a8c0acd3bd7a19c7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>0170dbc7eb7c3dcd99af539ae11b3fbab6b57e7a643b349740a2115359f75a3c</SHA-256>
              <SHA-1>d2b86f2fad5cd34121cab0fc9a6917fa5b19ddde</SHA-1>
              <MD5>c53303e8f08e504dd28481358d3eeb8d</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>01ea9709f862e520ca1ff459fff71d0c96ba7d78b143d2ff704b5588c6ce82ca</SHA-256>
              <SHA-1>b1d90de519dec7b0ab4a64aee18d9694f0119473</SHA-1>
              <MD5>359c56534c10d8fb56b07465c7dc64ed</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>296d9b8fe0da89e85fae42d7fff9322f56a409c12ca73cc7ab565e5916efd8d1</SHA-256>
              <SHA-1>846766a9659d8d2b178c81f061b9a8a9cc31b5d2</SHA-1>
              <MD5>849ef5df1e41fe15b0b24c6b72d69302</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>3cc6a073ddc287cf0db93a3bc34e666855e8acd000635d5ab8632b26efd2e6bb</SHA-256>
              <SHA-1>943d9e7e4b92624a41531cf25cc395a63730cf31</SHA-1>
              <MD5>80386f9d474db3df75809afa7d34486e</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>82dbd8140b002879507b0d95694bc4706c204236fb3c71407e2018618d8955a8</SHA-256>
              <SHA-1>3517db846f52ec98a249d94c3694da9ed804eaf8</SHA-1>
              <MD5>3c970c860fe36f62f27731fde53bc332</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>980314fe47250776467d46339621a0f6d4837814930c976d0b886e1ef42cf7f8</SHA-256>
              <SHA-1>fa1fcada752c17ab122e1a0f13977f985b2bad33</SHA-1>
              <MD5>cb39c92173bd1881c1d637aaff6c4789</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>a593a84faa7ab6bc8e0b03a9513abd954e2cd59f278a69b3931cebba8f850d4e</SHA-256>
              <SHA-1>68da36e9d0bd9a85ce611834cefe90970c0f1f97</SHA-1>
              <MD5>af10c85608f778c4cfa48bfccf079a15</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>ca787f69368fce1a6630897ad7f961686f4cd0da87eb138b1f980a7d575ec923</SHA-256>
              <SHA-1>8915db551b5f145fc60d88e74ca4f08743d15c6b</SHA-1>
              <MD5>bc2aa8dbae137e56a986d4f6cf6366bb</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>d7f9a162126c22db535a95febc1ca6bd864e96752dc513ce74c1c34a2ec50150</SHA-256>
              <SHA-1>90a2e4ae384bdd50a350ac73ab97b385d4b1b7b1</SHA-1>
              <MD5>a07dec46b0c8af3d7aea9e96aaf0f949</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>d9ab58e535c49c1857e06e46b3950660d0de80498a0a63067f14ddc855e06ca3</SHA-256>
              <SHA-1>db5da117b581fa93486aa8f42b2ca6c8061d6cea</SHA-1>
              <MD5>b9fefc1dc28025df1c17fb99bd1ff376</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>e5e3d9f7a3c9d0a9acc6ee8acd8f47847801fb7d7d8440892e47552238eceaf1</SHA-256>
              <SHA-1>97697fef9d1d8549d8b7354548f1a0d27479e328</SHA-1>
              <MD5>25bedd8e6229bc8b5b759f076b6be5fd</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e</SHA-256>
              <SHA-1>80c9820ff2efe8aa3d361df7011ae6eee35ec4f0</SHA-1>
              <MD5>4842e206e4cfff2954901467ad54169e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/octet-stream</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>64d307322fb7aa623d9cf40ecf61a6db92d01e84ca917495988eb14bb5a2d2c7</SHA-256>
              <SHA-1>ddfcb04ecdade584e408543720a2411b5e9ae35e</SHA-1>
              <MD5>0edd996dd913589eba6b3e7f9c845333</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>10784-asi-loader.exe</name>
        <report_id>d48de8c1-8b3a-4376-95bc-6b57b628f409</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>data</value>
          <value>packer</value>
          <value>anti-debug</value>
          <value>overlay</value>
          <value>obfuscated</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>packed</value>
          <value>expired-cert</value>
          <value>microsoft_visual_cc</value>
          <value>upx</value>
          <value>signed</value>
          <value>zero-day</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>481f9ba274488e9ce659ed7d18be25379208eee1591978bbc4da54a19fe59af4</id>
    <title>Analysis Report for 481f9ba274488e9ce659ed7d18be25379208eee1591978bbc4da54a19fe59af4</title>
    <updated>2026-08-20T22:16:59Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877cecf2677ae4d366d830</_id>
        <file_type>application/octet-stream</file_type>
        <flow_id>6a877cdaeeadd95beca17727</flow_id>
        <hash>481f9ba274488e9ce659ed7d18be25379208eee1591978bbc4da54a19fe59af4</hash>
        <iocs>
          <emails>
            <value>
              <email>3tW4.CW@D.g4.Dg</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <btc_wallets>
            <value>
              <btc_wallet>x6ba262:$btc: 343PF33E333Af33d3C34FCCc46C3</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x7ff546:$btc: 11wCD1w4C1wD41wGD7wsG7w3ssw3</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x80e818:$btc: 3f3cffvWVvwwVvgDDDDUUeffvfwwVf</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x8724d7:$btc: 36223c62223333SS6355cVUU3cfU</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x87322b:$btc: 33t7DDvgffv73tfGDvfgfvfwwf</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x875bde:$btc: 33f6Uef2Uf62ef22f622f2226222</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>soulgold.bps</name>
        <report_id>e527f7ee-c56c-4737-9b0d-d147ce717791</report_id>
        <tags>
          <value>data</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8eb8dbf91b6e422af4e6f36d687ac52bc978a15ba5ce43175edb6a23c26c4915</id>
    <title>Analysis Report for 8eb8dbf91b6e422af4e6f36d687ac52bc978a15ba5ce43175edb6a23c26c4915</title>
    <updated>2026-08-20T22:15:56Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877cc6f2677ae4d366d821</_id>
        <file_type>application/x-bittorrent</file_type>
        <flow_id>6a877c9aeeadd95beca176a1</flow_id>
        <hash>8eb8dbf91b6e422af4e6f36d687ac52bc978a15ba5ce43175edb6a23c26c4915</hash>
        <iocs>
          <urls>
            <value>
              <url>http://bt1.archive.org:6969/announce13:announce-listll36:</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://bt1.archive.org:6969/announceel36:</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://bt2.archive.org:6969/announceee7:comment686:This</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://archive.org/details/1986-pokemon-emerald-u-trash-man</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://archive.org/download/1986-pokemon-emerald-u-trash-man/1986-pokemon-emerald-u-trash-man_archive.torrent</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>archive.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>bt1.archive.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>bt2.archive.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>207.241.224.2</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>207.241.226.111</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>207.241.231.226</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>02c5c1dcbfb32e3123cd2f8147cc9009f54b53b89014fb4858b950eb577113c5</SHA-256>
              <SHA-1>2787db9b12c77337fccc8c80f946d878b9ffa1af</SHA-1>
              <MD5>4a421ba206924a4a1027f8531b93e932</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>38af95e189df3d3c600f6e7008647c1e5e1b558ca6033417e8dc8d2644d343c0</SHA-256>
              <SHA-1>29458f484598be3a9aef4f244a41fb2ce9a2c2c4</SHA-1>
              <MD5>cda7f1db8c84c7fbe25dbff61e0d647d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>8eb8dbf91b6e422af4e6f36d687ac52bc978a15ba5ce43175edb6a23c26c4915</SHA-256>
              <SHA-1>97fec350bf813dc12bd484350445a078b9e04e5b</SHA-1>
              <MD5>4fd3a9ee321e8215c3e9351d94274997</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/x-bittorrent</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>1986-pokemon-emerald-u-trash-man_archive.torrent</name>
        <report_id>54dfca2a-da01-44b5-9e7d-81dfbbbb24f4</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9d99a52cb48ad8891edf09f455a64f36c579da12fc8a8003aec6f0fe35dfb107</id>
    <title>Analysis Report for 9d99a52cb48ad8891edf09f455a64f36c579da12fc8a8003aec6f0fe35dfb107</title>
    <updated>2026-08-20T22:15:56Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877ca7f2677ae4d366d816</_id>
        <file_type>application/xml</file_type>
        <flow_id>6a877c9aeeadd95beca176a1</flow_id>
        <hash>9d99a52cb48ad8891edf09f455a64f36c579da12fc8a8003aec6f0fe35dfb107</hash>
        <iocs/>
        <name>1986-pokemon-emerald-u-trash-man_files.xml</name>
        <report_id>bceb516a-7c62-4eb3-a1c9-93fe6ddc1aef</report_id>
        <tags>
          <value>xml</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>efbcbba7f66052b8ac88cb6b6a68f2a49031c8388ae8c62d66ba3c2f8c0b0ec0</id>
    <title>Analysis Report for efbcbba7f66052b8ac88cb6b6a68f2a49031c8388ae8c62d66ba3c2f8c0b0ec0</title>
    <updated>2026-08-20T22:15:56Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877cdcf2677ae4d366d829</_id>
        <file_type>application/xml</file_type>
        <flow_id>6a877c9aeeadd95beca176a1</flow_id>
        <hash>efbcbba7f66052b8ac88cb6b6a68f2a49031c8388ae8c62d66ba3c2f8c0b0ec0</hash>
        <iocs>
          <urls>
            <value>
              <url>http://creativecommons.org/publicdomain/zero/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>creativecommons.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>ari1333@stonefields.school.nz</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>validator@archive.org</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>104.20.5.134</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>4ceb8ae6835f2f5263caa0e39c9e1adca9469686c267475049b33521dabbe339</SHA-256>
              <SHA-1>de025b94c2bbb9a53e296bcd65bb8e0e9cf7f392</SHA-1>
              <MD5>91f8c23a03651fba48d9e81581265b1b</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>1986-pokemon-emerald-u-trash-man_meta.xml</name>
        <report_id>c2defc0a-f4e9-4283-bf96-2fc49db05f84</report_id>
        <tags>
          <value>xml</value>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a9dec84dfe7f62ab2220bafaef7479da0929d066ece16a6885f6226db19085af</id>
    <title>Analysis Report for a9dec84dfe7f62ab2220bafaef7479da0929d066ece16a6885f6226db19085af</title>
    <updated>2026-08-20T22:15:56Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877ceef2677ae4d366d831</_id>
        <file_type>application/octet-stream</file_type>
        <flow_id>6a877c9aeeadd95beca176a1</flow_id>
        <hash>a9dec84dfe7f62ab2220bafaef7479da0929d066ece16a6885f6226db19085af</hash>
        <iocs>
          <btc_wallets>
            <value>
              <btc_wallet>x35a80b:$btc: 3UUUUUUUUUUUUUUUUUUUUUUUxU</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x35c28c:$btc: 13331333133313331333A333A43</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x367be0:$btc: 1DUUCUUUTUUUTUUEUUE4UUDCUUDDUE</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x369c4b:$btc: 3U45DU4TCU4EEECUT4TUE3C3CC4C</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x36b10b:$btc: 3U45DU4TCU4EEECUT4TUE3C3CC4C</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x3f6fa1:$btc: 1P2Q2Q2Q2Q2Y2Y2Q2Q2Q2Q2Q2Q2Q2R</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x3f9df3:$btc: 1y2y2y2y2y2y2y2y2y2y2y2y2y</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x46f855:$btc: 1P2Q2Q2Q2Q2Y2Y2Q2Q2Q2Q2Q2Q2Q2R</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x487812:$btc: 3FU43FUE3FUUDFwwwGwwwGfff</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x4903cc:$btc: 333T33CU33sw3333ffffwwwwww</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>1986 - Pokemon Emerald (U)(TrashMan).gba</name>
        <report_id>415b7270-4de3-4865-8a8e-235d50c105f2</report_id>
        <tags>
          <value>data</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9ffa4ebf02fb1ba51d20904dddd8abd0220c02f3e43d99c13f6a49392873c2f4</id>
    <title>Analysis Report for 9ffa4ebf02fb1ba51d20904dddd8abd0220c02f3e43d99c13f6a49392873c2f4</title>
    <updated>2026-08-20T22:15:56Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877cf5f2677ae4d366d834</_id>
        <file_type>application/x-sqlite3</file_type>
        <flow_id>6a877c9aeeadd95beca176a1</flow_id>
        <hash>9ffa4ebf02fb1ba51d20904dddd8abd0220c02f3e43d99c13f6a49392873c2f4</hash>
        <iocs>
          <urls>
            <value>
              <url>https://archive.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://archive.org/upload/?identifier=1986-pokemon-emerald-u-trash-man</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>archive.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>207.241.224.2</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>38491d23655801f18932ca78fce261d76f70efa7b3c60344ec73fe77a2deab67</SHA-256>
              <SHA-1>5e3be66f57330062e52ba818646a28def5901955</SHA-1>
              <MD5>2305397a42f5b93e50c488ed0b20e525</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>198656d6a1b94955f0b40b5c2a22c1daf798b235e9560673d0fc0e17472c3bd4</SHA-256>
              <SHA-1>d392dd5ef546e508a36deed63e134c707134ca29</SHA-1>
              <MD5>0b36d92d6bfc974bb73dab6f31728527</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>1986-pokemon-emerald-u-trash-man_meta.sqlite</name>
        <report_id>bc12cbe6-5630-4605-a91c-c5872a61e2c0</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>3e4d9e4dd954cd205f99fa5e6772c2cc8d129d5894fb1759855ff16d1643910d</id>
    <title>Analysis Report for 3e4d9e4dd954cd205f99fa5e6772c2cc8d129d5894fb1759855ff16d1643910d</title>
    <updated>2026-08-20T22:15:03Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877c8bf2677ae4d366d80e</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877c67b107fd4d6e901162</flow_id>
        <hash>3e4d9e4dd954cd205f99fa5e6772c2cc8d129d5894fb1759855ff16d1643910d</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.e-servce.com/lunchdelivery/c3db409e26?l=3</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://tslp.s3.amazonaws.com/detect/plugin_detect.js?guid=c3db409e26&amp;correlation_id=de2970ce-32b8-4eab-9502-b36e659ef197</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.e-servce.com:49153/alt_pixel_click_c3db409e26.gif?correlation_id=de2970ce-32b8-4eab-9502-b36e659ef197</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://d25q7gseii1o1q.cloudfront.net/training/fish/mail.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Open+Sans:400,700</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tslp.s3.amazonaws.com/assets/js/training.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tslp.s3.amazonaws.com/detect/plugin_detect.js?guid=c3db409e26&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tslp.s3.amazonaws.com/languages/language.18071.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tslp.s3.amazonaws.com/training/embedded/css/url.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tslp.s3.amazonaws.com/training/embedded/translations/url/en-us.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tslp.s3.amazonaws.com/training/production/314/hooks-a3eab7.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tslp.s3.amazonaws.com/training/teachable_moments/css/langdrop.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/assets/ajax/libs/jquery/1.11.0/jquery.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/assets/ajax/libs/jquery/1.9.1/jquery.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/assets/all.js?g=c3db409e26</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/assets/all.js?guid=c3db409e26&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/load_training?guid=56c3db48c09e26a5&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/log?id=c3db409e26&amp;campaign_guid=6a2783faab&amp;msg=Loading%20embedded%20html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/log?id=c3db409e26&amp;campaign_guid=6a2783faab&amp;msg=embeddedhtmlemail%20id%20exists%20with%20environment%20%3D%20production</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/log?id=c3db409e26&amp;campaign_guid=6a2783faab&amp;msg=logo_object%20does%20not%20exist</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/lunchdelivery/c3db409e26?l=3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/secure/browser_post</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=BrowserDetect%20-%20browser%20%3D%20Chrome&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=BrowserDetect%20-%20browser_version%20%3D%20125&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=BrowserDetect%20-%20colorDepth%20%3D%2024&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=BrowserDetect%20-%20hasCookies%20%3D%20true&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=BrowserDetect%20-%20height%20%3D%20600&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=BrowserDetect%20-%20language%20%3D%20en-US&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=BrowserDetect%20-%20localStorage%20%3D%20true&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=BrowserDetect%20-%20os%20%3D%20Linux&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=BrowserDetect%20-%20os_version%20%3D%2010&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=BrowserDetect%20-%20plugin%20Chrome%20PDF%20Viewer&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=BrowserDetect%20-%20plugin%20Chromium%20PDF%20Viewer&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=BrowserDetect%20-%20plugin%20Microsoft%20Edge%20PDF%20Viewer&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=BrowserDetect%20-%20plugin%20PDF%20Viewer&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=BrowserDetect%20-%20plugin%20WebKit%20built-in%20PDF&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=BrowserDetect%20-%20width%20%3D%20800&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=Chrome%20browser%2C%20using%20more%20detailed%20version&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=Skipping%20RealPlayer%20detection&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=Skipping%20Silverlight%20detection&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=Skipping%20WindowsMediaPlayer%20detection&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=Skipping%20flash%20detection&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=Skipping%20java%20detection&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=Skipping%20pdf%20detection&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=Skipping%20quicktime%20detection&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=redirect_url%20is%20undefined&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=56c3db48c09e26a5&amp;msg=training_page_no_browser_post&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=BrowserDetect%20-%20browser%20%3D%20Chrome&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=BrowserDetect%20-%20browser_version%20%3D%20125&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=BrowserDetect%20-%20colorDepth%20%3D%2024&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=BrowserDetect%20-%20hasCookies%20%3D%20true&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=BrowserDetect%20-%20height%20%3D%20600&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=BrowserDetect%20-%20language%20%3D%20en-US&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=BrowserDetect%20-%20localStorage%20%3D%20true&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=BrowserDetect%20-%20os%20%3D%20Linux&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=BrowserDetect%20-%20os_version%20%3D%2010&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=BrowserDetect%20-%20plugin%20Chrome%20PDF%20Viewer&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=BrowserDetect%20-%20plugin%20Chromium%20PDF%20Viewer&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=BrowserDetect%20-%20plugin%20Microsoft%20Edge%20PDF%20Viewer&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=BrowserDetect%20-%20plugin%20PDF%20Viewer&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=BrowserDetect%20-%20plugin%20WebKit%20built-in%20PDF&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=BrowserDetect%20-%20width%20%3D%20800&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=Chrome%20browser%2C%20using%20more%20detailed%20version&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=Skipping%20RealPlayer%20detection&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=Skipping%20Silverlight%20detection&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=Skipping%20WindowsMediaPlayer%20detection&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=Skipping%20flash%20detection&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=Skipping%20java%20detection&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=Skipping%20pdf%20detection&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=Skipping%20quicktime%20detection&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=browser_post_successful&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=c3db409e26&amp;msg=redirecting%20to%20%2Fload_training%3Fguid%3D56c3db48c09e26a5%26correlation_id%3Dfca78450-53fc-4555-a5e9-95b4e5d09305&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=undefined&amp;msg=window.tracking_id%20is%20not%20set%2C%20let%27s%20get%20it&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=unknown&amp;msg=did%20not%20find%20guid%20in%20last%20part%20of%20location&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/trace?id=unknown&amp;msg=get-id%20is%20undefined&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com/training_screenshot?guid=c3db409e26&amp;correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.e-servce.com:49153/alt_pixel_click_c3db409e26.gif?correlation_id=fca78450-53fc-4555-a5e9-95b4e5d09305</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.proofpoint.com/legal/trust</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>ajax.googleapis.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>d25q7gseii1o1q.cloudfront.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>tslp.s3.amazonaws.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.e-servce.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.e-servce.com:49153</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.proofpoint.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>tslp.s3.amazonaws.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.e-servce.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.127.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.13.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.14.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>16.182.74.65</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>18.64.181.70</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>34.233.104.201</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>52.2.16.80</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>52.217.115.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>52.2.16.80</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>c0623a98220d6586761a01bc71f85279d1893f40e75400864b0f9048bc2b0bfe</SHA-256>
              <SHA-1>68cd806bcb5002034b5b143747636883483f3736</SHA-1>
              <MD5>cf0ae9d292ac3c2d9c565ac15bcacc77</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>4bab432979d731f8264bcd9d40422ca7dfcfcb0e0e703288db78bbfa555f853a</SHA-256>
              <SHA-1>f0c03b1c50f39c95075df687cd55f18861631526</SHA-1>
              <MD5>00a513f07603df01e3b99be00f370754</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>de2970ce-32b8-4eab-9502-b36e659ef197</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://www.e-servce.com/lunchdelivery/c3db409e26?l=3</name>
        <report_id>936589f1-4a91-42cb-9809-c769dd311f11</report_id>
        <tags>
          <value>html</value>
          <value>javascript</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>04f0d2a4ad540ab6d6f7dd1f140ebc1cc8d320d18e5e1b63d2eaae5f02c0474c</id>
    <title>Analysis Report for 04f0d2a4ad540ab6d6f7dd1f140ebc1cc8d320d18e5e1b63d2eaae5f02c0474c</title>
    <updated>2026-08-20T22:13:39Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877c43f2677ae4d366d7f9</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877c10b107fd4d6e901061</flow_id>
        <hash>04f0d2a4ad540ab6d6f7dd1f140ebc1cc8d320d18e5e1b63d2eaae5f02c0474c</hash>
        <iocs>
          <urls>
            <value>
              <url>github.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/common/federation/oauth2msa</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://aadcdn.msauth.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_pzfy2abhlubh6bv_dyvwha2.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_lzfw9ovraljpmqc6m13khq2.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/watson.min_82o5oyf7tvyeotpacdeksw2.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/https://aadcdn.msftauth.net/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/shared/1.0/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_iGr4o2yoBDyfwvXs2HIE3g2.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://aadcdn.msauthimages.net/dbd5a2dd-gquzkcpgfutbzyjnpplp8vebdbavzszkfhtbvajkuvi/logintenantbranding/0/bannerlogo?ts=637838346661992232</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://aadcdn.msauthimages.net/dbd5a2dd-gquzkcpgfutbzyjnpplp8vebdbavzszkfhtbvajkuvi/logintenantbranding/0/illustration?ts=637838154765350354</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://aadcdn.msftauth.net/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://account.live.com/password/reset?wreply=https%3a%2f%2flogin.microsoftonline.com%2f601ee552-4158-437a-9d8b-37c08a727d42%2freprocess%3fctx%3drQQIARAAnVNbiBvnFdasNrJXtZNd1fSxl8WUYkfe-eeubf0wM5rLznpGmtFcpAnp9tfM7M5VGkujXUnGoZRAXChl_VAIfSmkhhQ3DyGQYEzBLYQmmNI4MSSwaSFukzYEGjt9clIKRe5LH0PPw8d3OOc7fOfAOVMG58DmafS_gdcXWEd3d0HdCxbsf2JUq66-gFPPv14qPTi-_MX9p7915nfXESosiny8ubEReKE_xCmyns3OjUM4CvJhNCjOecNsY2d3OMrGG36wCydpcQ6O8-kNBLmDIB8jyPWli5TIszzAmpjQ4FiG4BoMIEgUxVlcoFBCAJxAYQRPNUmebRKcQNVRgWcEnGQZrgEIgPEcShIEQ-PNBgVQniJ4QGBsoykwPMeSPMAo0CRphqOaPCBwwGBHS0-02EkRYgsYjqJ58M-llYXHnXw4Ln5efn251UQPlFidtS2RM2V3Ylkip1uKoc23CDUVEwukF2Dmchaa9zqRNTOyLQLaQ8Ke2xiUUAyaxlQfJHNVzDlfHh74UtHR4hRqqaF6ibjtA63tCwXo2C5uZOrMlcStXqzYvuDN7ZiL9HRvpiak2rPzfTNRUkOa9hRT4TuCyJlZ4bYE0rLkEFPn3MhAydCwNd165CPVDMmYOBYxsywSWrLYMTErVZNeqiZK4QHNsNHCNYSpZkqNXktOCS1Np_5soSVdHQNx30yHgezOVdslgmR44EqNliaBbSfzSRcX24qpSCqwqYUfq2lLnuObdjeNtK4o9u0QGFkKXYvsujYXm11x38REriP3AIwN10OVeT8DrtfVIogpcT9hcFVQeMMRZ4t5BlCafdu3dczObSkfGVbDhE6Yac5eqiZuNxhwuCUVhS2FHFzsG1kzfZBDw9GJjqVhfdGHvqg4Vipuu7ayDWN2oQOelFsanhZuZnAabm-1LFI2HXdgZMTiLrO-LJCLvaDp4R3emulZOnTE0DbsdMvoWDM9TiknI7Ce7Y8WfZqjz3RbX2hzO7EjD9gXgoEomCDt9LqpoZiacL38pd7qlfJpCgVBQJJYnQAkUydwGtYbPtOv47SHMpDGaJ_AbpcrwzwYRP6dZeST5SUUebiMvPBYrbp69wcb7ypP_qH1i3duPPfi-07p9mMbTVHAsi0xCwNuV-5f7GwzyujsPB04gsdm-7a6193eIMgYRtLBeXITHFaQw0rlsKIcVr56s7JyvLxaWi_zbfCgglw5Vrq58n---PNV5M5XkKMToLriDfsjOPAjv3YagL7PoAxeZ-gArROgT9b7fZqpo32PwD0GMgEDj04Q1YqXwigb185cWo_8nWKYBIP1zUvr02y843kLtg_TSTBe33xqnW-D9acvX778o5NfavpvT5YePn717rWjZ-_dui9_8sSTe7qvXRzQij8Rphe8g8kgwmweGw_OyiQOUS7DD4yYNAqOKpLzL6-WPlgtXV_7aKmaV4lSqYR-W4j_8tcPr37ja5_Oen_64_dO__jWy9f-Fh2jf9X-fXiUrJb__MXKyrPWb_Z-eO_qv3vz76_VHqluX3rnpdceRr0H7j9OVcK7b_9r6eNXdl499dyp7_70mc_fzt76_I1rJw9_ff_Ge3-_1SJ_GXz2TeQ7SO3xahmme7VjAt-U60JnkQcDr3aMxUhK4tXaHaRahvl-7U2EZVmWt-zQS7QxdOyJL-2xLMuJOjqeq4-KrggnF2JSEXbFCUk6_rzV5jvKPs0nZJbIGhXq0yyGcMo28d2hwvcMe18KWMKVG043DwQvp9GLM-yslLqMOCpE1h2iDZlmJ9GsS1tWONXpeECTqIO3z3pB0nT5EU3HXZJutDWopYy-sBPO-yxGqfKWGjQZXaW6vkSZsdeIYVcJsj1dOH9zrVZd3b9y7_gBfEa-8epbPzvx9d5PPlgrPVw7LF-plf4D0%5Cu0026mkt=en-US</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://echdo365-my.sharepoint.com/_forms/default.aspx</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://go.microsoft.com/fwlink/?linkid=2013738</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://go.microsoft.com/fwlink/p/?LinkID=733247</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.live.com/Me.htm?v=3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://login.live.com/forg</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.live.com/forgetme.srf</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.live.com/forgetme.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.live.com/logout.srf</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.live.com/logout.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.live.com/oauth20_authorize.srf</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access%5Cu0026response_type=code%5Cu0026client_id=51483342-085c-4d86-bf88-cf50c7252078%5Cu0026response_mode=form_post%5Cu0026redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa%5Cu0026state=rQQIARAAnVNbiBvnFdasNrJXtZNd1fSxl8WUYkfe-eeubf0wM5rLznpGmtFcpCnp9tfM7M5VkqWRVpJxKCUQF0pZPxRCXgqpocXtgwmkGFNwAqEtpjRODC1sW4h7DYHWbp-clEIZ96WPod_Dxzmc8x2-c-CcK4MLYPss-l_g9YLr6P4-qHtBEf0PxrXq-ms49crbpdLjk6sfP3rhC-feehVZ20ujWXDBG2Y3ESrM89Fke2sr8EJ_iFNkPVtcmIRwHIyG0SAvmrb29ofjbLLlB_twmuYX4GQ0v40g9xHkAwS5uXKZEnmWB1gTExocyxBcgwEEiaI4iwsUSgiAEyiM4KkmybNNghOoOirwjICTLMM1AAEwnkNJgmBovNmgAMpTBA8IjG00BYbnWJIHGAWaJM1wVJMHBA4Y7HjluRY7zUOsoOE4Wgb_XFkrPO6NhpP81fLbq60meqjE6qJtiZwpu1PLEjndUgxtuUOoqZhYIL0EM5ez0FGvE1kLI9shoD0k7KWNQQnFoGnM9UGyVMUR58vDQ1_KO1qcQi01VC8Rd32gtX0hBx3bxY1MXbiSuNOLFdsXvKUdc5GeHizUhFR79mhmJkpqSPOeYip8RxA5M8vdlkBalhxi6pIbGygZGramW099pJohGVPHIhaWRUJLFjsmZqVq0kvVRMk9oBk2mruGMNdMqdFrySmhpencXxRa0tUxEPfNdBjI7lK1XSJIhoeu1GhpEth1Mp90cbGtmIqkApsq_FhNW_Ic37S7aaR1RbFvh8DIUuhaZNe1udjsijMTE7mO3AMwNlwPVZb9DLheV4sgpsT9hMFVQeENR1wU8wygNPu2b-uYPbKl0diwGiZ0wkxzDlI1cbvBgMMtKc9tKeRgsW9kLfTBCBqOTnQsDeuLPvRFxbFScde1lV0Ys4UOeNLI0vA0dzOD03B7p2WRsum4AyMjirss-rJAFntB08M7vLXQs3ToiKFt2OmO0bEWepxSTkZgPdsfF32aoy90Wy-0IzuxIw_Yl4KBKJgg7fS6qaGYmnCz_Ile7PXyWQoFQUCSWJ0AJFMncBrWGz7Tr-O0hzKQxmifwO6VK8NRMIj8-6vIh6srKPJkFXntmVp1_cHXt36tPP_L1vfeu_3yD37rlO49s9UUBSzbEbMw4Pbl_uXOLqOMzy_TgSN4bDaz1YPu7hZBxjCSDi-S2-CoghxVKkcV5ajy6TuVtZPl9dJmmW-DxxXk2onSnbX_88VfqSL3P4XcOoUcnwLVNW_YH8OBH_m1swD0fQZl8DpDB2idAH2y3u_TTB3tewTuMZAJGHh8iqhWvBRG2aR27spm5O_lwyQYbG5f2Zxnkz3PK6IZTKfBZHP7q5t8G2y-cPXq1W-e_kTT3zxdevLs9Qc3jl96ePeR_OFzzx_ovnZ5QCv-VJhf8g6ngwizeWwyOC-TOES5DD80YtLIOSpPLt5aL72_Xrq58eeV6qhKlEol9ItC_Ic__un65z7z90Xvd7_6ytlv3b114y_RCfqH7Z-Fx8l6-fcfr629ZP304BsPr_-7t_zaRu2p6t6V9378kydR77H7tzOV8MG7_1r54PW9N868fObL33nxo3ezdz76-Y3TRz96dPs3f73bIr8f_OPzyJeQ2rPVMkwPaicEvinXhU6RBwOvdoLFSEri1dp9pFqGo1ntFwjLsixv2aGXaBPo2FNfOmBZlhN1dLJUnxZdEU4vxaQi7ItTknT8ZavNd5QZzSdklsgaFerzLIZwzjbx_aHC9wx7JgUs4coNpzsKBG9Eo5cX2HkpdRlxnIusO0QbMs1Oo0WXtqxwrtPxgCZRB2-f94Kk6fJjmo67JN1oa1BLGb2wEy77LEap8o4aNBldpbq-RJmx14hhVwmyA124eGejVl2fXXt48hC-KN9-453vnvps79vvb5SebByVr9VK_wE1%5Cu0026estsfed=1%5Cu0026uaid=983633a200c4f0000804faef5d212ac1%5Cu0026cobrandid=11bd8083-87e0-41b5-bb78-0bc43c8a8e8a%5Cu0026fci=00000003-0000-0ff1-ce00-000000000000%5Cu0026wsucxt=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access%5Cu0026response_type=code%5Cu0026client_id=51483342-085c-4d86-bf88-cf50c7252078%5Cu0026response_mode=form_post%5Cu0026redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa%5Cu0026state=rQQIARAAnVNbiBvnFdasNrJXtZNd1fSxl8WUYkfe-eeubf0wM5rLznpGmtFcpCnp9tfM7M5VkqWRVpJxKCUQF0pZPxRCXgqpocXtgwmkGFNwAqEtpjRODC1sW4h7DYHWbp-clEIZ96WPod_Dxzmc8x2-c-CcK4MLYPss-l_g9YLr6P4-qHtBEf0PxrXq-ms49crbpdLjk6sfP3rhC-feehVZ20ujWXDBG2Y3ESrM89Fke2sr8EJ_iFNkPVtcmIRwHIyG0SAvmrb29ofjbLLlB_twmuYX4GQ0v40g9xHkAwS5uXKZEnmWB1gTExocyxBcgwEEiaI4iwsUSgiAEyiM4KkmybNNghOoOirwjICTLMM1AAEwnkNJgmBovNmgAMpTBA8IjG00BYbnWJIHGAWaJM1wVJMHBA4Y7HjluRY7zUOsoOE4Wgb_XFkrPO6NhpP81fLbq60meqjE6qJtiZwpu1PLEjndUgxtuUOoqZhYIL0EM5ez0FGvE1kLI9shoD0k7KWNQQnFoGnM9UGyVMUR58vDQ1_KO1qcQi01VC8Rd32gtX0hBx3bxY1MXbiSuNOLFdsXvKUdc5GeHizUhFR79mhmJkpqSPOeYip8RxA5M8vdlkBalhxi6pIbGygZGramW099pJohGVPHIhaWRUJLFjsmZqVq0kvVRMk9oBk2mruGMNdMqdFrySmhpencXxRa0tUxEPfNdBjI7lK1XSJIhoeu1GhpEth1Mp90cbGtmIqkApsq_FhNW_Ic37S7aaR1RbFvh8DIUuhaZNe1udjsijMTE7mO3AMwNlwPVZb9DLheV4sgpsT9hMFVQeENR1wU8wygNPu2b-uYPbKl0diwGiZ0wkxzDlI1cbvBgMMtKc9tKeRgsW9kLfTBCBqOTnQsDeuLPvRFxbFScde1lV0Ys4UOeNLI0vA0dzOD03B7p2WRsum4AyMjirss-rJAFntB08M7vLXQs3ToiKFt2OmO0bEWepxSTkZgPdsfF32aoy90Wy-0IzuxIw_Yl4KBKJgg7fS6qaGYmnCz_Ile7PXyWQoFQUCSWJ0AJFMncBrWGz7Tr-O0hzKQxmifwO6VK8NRMIj8-6vIh6srKPJkFXntmVp1_cHXt36tPP_L1vfeu_3yD37rlO49s9UUBSzbEbMw4Pbl_uXOLqOMzy_TgSN4bDaz1YPu7hZBxjCSDi-S2-CoghxVKkcV5ajy6TuVtZPl9dJmmW-DxxXk2onSnbX_88VfqSL3P4XcOoUcnwLVNW_YH8OBH_m1swD0fQZl8DpDB2idAH2y3u_TTB3tewTuMZAJGHh8iqhWvBRG2aR27spm5O_lwyQYbG5f2Zxnkz3PK6IZTKfBZHP7q5t8G2y-cPXq1W-e_kTT3zxdevLs9Qc3jl96ePeR_OFzzx_ovnZ5QCv-VJhf8g6ngwizeWwyOC-TOES5DD80YtLIOSpPLt5aL72_Xrq58eeV6qhKlEol9ItC_Ic__un65z7z90Xvd7_6ytlv3b114y_RCfqH7Z-Fx8l6-fcfr629ZP304BsPr_-7t_zaRu2p6t6V9378kydR77H7tzOV8MG7_1r54PW9N868fObL33nxo3ezdz76-Y3TRz96dPs3f73bIr8f_OPzyJeQ2rPVMkwPaicEvinXhU6RBwOvdoLFSEri1dp9pFqGo1ntFwjLsixv2aGXaBPo2FNfOmBZlhN1dLJUnxZdEU4vxaQi7ItTknT8ZavNd5QZzSdklsgaFerzLIZwzjbx_aHC9wx7JgUs4coNpzsKBG9Eo5cX2HkpdRlxnIusO0QbMs1Oo0WXtqxwrtPxgCZRB2-f94Kk6fJjmo67JN1oa1BLGb2wEy77LEap8o4aNBldpbq-RJmx14hhVwmyA124eGejVl2fXXt48hC-KN9-453vnvps79vvb5SebByVr9VK_wE1%5Cu0026estsfed=1%5Cu0026uaid=983633a200c4f0000804faef5d212ac1%5Cu0026cobrandid=11bd8083-87e0-41b5-bb78-0bc43c8a8e8a%5Cu0026fci=00000003-0000-0ff1-ce00-000000000000%5Cu0026wsucxt=1%5Cu0026idp_hint=github.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access%5Cu0026response_type=code%5Cu0026client_id=51483342-085c-4d86-bf88-cf50c7252078%5Cu0026response_mode=form_post%5Cu0026redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa%5Cu0026state=rQQIARAAnVNbiBvnFdasNrJXtZNd1fSxl8WUYkfe-eeubf0wM5rLznpGmtFcpCnp9tfM7M5VkqWRVpJxKCUQF0pZPxRCXgqpocXtgwmkGFNwAqEtpjRODC1sW4h7DYHWbp-clEIZ96WPod_Dxzmc8x2-c-CcK4MLYPss-l_g9YLr6P4-qHtBEf0PxrXq-ms49crbpdLjk6sfP3rhC-feehVZ20ujWXDBG2Y3ESrM89Fke2sr8EJ_iFNkPVtcmIRwHIyG0SAvmrb29ofjbLLlB_twmuYX4GQ0v40g9xHkAwS5uXKZEnmWB1gTExocyxBcgwEEiaI4iwsUSgiAEyiM4KkmybNNghOoOirwjICTLMM1AAEwnkNJgmBovNmgAMpTBA8IjG00BYbnWJIHGAWaJM1wVJMHBA4Y7HjluRY7zUOsoOE4Wgb_XFkrPO6NhpP81fLbq60meqjE6qJtiZwpu1PLEjndUgxtuUOoqZhYIL0EM5ez0FGvE1kLI9shoD0k7KWNQQnFoGnM9UGyVMUR58vDQ1_KO1qcQi01VC8Rd32gtX0hBx3bxY1MXbiSuNOLFdsXvKUdc5GeHizUhFR79mhmJkpqSPOeYip8RxA5M8vdlkBalhxi6pIbGygZGramW099pJohGVPHIhaWRUJLFjsmZqVq0kvVRMk9oBk2mruGMNdMqdFrySmhpencXxRa0tUxEPfNdBjI7lK1XSJIhoeu1GhpEth1Mp90cbGtmIqkApsq_FhNW_Ic37S7aaR1RbFvh8DIUuhaZNe1udjsijMTE7mO3AMwNlwPVZb9DLheV4sgpsT9hMFVQeENR1wU8wygNPu2b-uYPbKl0diwGiZ0wkxzDlI1cbvBgMMtKc9tKeRgsW9kLfTBCBqOTnQsDeuLPvRFxbFScde1lV0Ys4UOeNLI0vA0dzOD03B7p2WRsum4AyMjirss-rJAFntB08M7vLXQs3ToiKFt2OmO0bEWepxSTkZgPdsfF32aoy90Wy-0IzuxIw_Yl4KBKJgg7fS6qaGYmnCz_Ile7PXyWQoFQUCSWJ0AJFMncBrWGz7Tr-O0hzKQxmifwO6VK8NRMIj8-6vIh6srKPJkFXntmVp1_cHXt36tPP_L1vfeu_3yD37rlO49s9UUBSzbEbMw4Pbl_uXOLqOMzy_TgSN4bDaz1YPu7hZBxjCSDi-S2-CoghxVKkcV5ajy6TuVtZPl9dJmmW-DxxXk2onSnbX_88VfqSL3P4XcOoUcnwLVNW_YH8OBH_m1swD0fQZl8DpDB2idAH2y3u_TTB3tewTuMZAJGHh8iqhWvBRG2aR27spm5O_lwyQYbG5f2Zxnkz3PK6IZTKfBZHP7q5t8G2y-cPXq1W-e_kTT3zxdevLs9Qc3jl96ePeR_OFzzx_ovnZ5QCv-VJhf8g6ngwizeWwyOC-TOES5DD80YtLIOSpPLt5aL72_Xrq58eeV6qhKlEol9ItC_Ic__un65z7z90Xvd7_6ytlv3b114y_RCfqH7Z-Fx8l6-fcfr629ZP304BsPr_-7t_zaRu2p6t6V9378kydR77H7tzOV8MG7_1r54PW9N868fObL33nxo3ezdz76-Y3TRz96dPs3f73bIr8f_OPzyJeQ2rPVMkwPaicEvinXhU6RBwOvdoLFSEri1dp9pFqGo1ntFwjLsixv2aGXaBPo2FNfOmBZlhN1dLJUnxZdEU4vxaQi7ItTknT8ZavNd5QZzSdklsgaFerzLIZwzjbx_aHC9wx7JgUs4coNpzsKBG9Eo5cX2HkpdRlxnIusO0QbMs1Oo0WXtqxwrtPxgCZRB2-f94Kk6fJjmo67JN1oa1BLGb2wEy77LEap8o4aNBldpbq-RJmx14hhVwmyA124eGejVl2fXXt48hC-KN9-453vnvps79vvb5SebByVr9VK_wE1%5Cu0026estsfed=1%5Cu0026uaid=983633a200c4f0000804faef5d212ac1%5Cu0026signup=1%5Cu0026lw=1%5Cu0026fl=easi2%5Cu0026cobrandid=11bd8083-87e0-41b5-bb78-0bc43c8a8e8a%5Cu0026fci=00000003-0000-0ff1-ce00-000000000000%5Cu0026wsucxt=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.live.com/ppsecure/partnerpost.srf</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.live.com/ppsecure/partnerpost.srf?scope=openid+profile+email+offline_access%5Cu0026response_type=code%5Cu0026client_id=51483342-085c-4d86-bf88-cf50c7252078%5Cu0026response_mode=form_post%5Cu0026redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa%5Cu0026state=rQQIARAAnVNbiBvnFdasNrJXtZNd1fSxl8WUYkfe-eeubf0wM5rLznpGmtFcpCnp9tfM7M5VkqWRVpJxKCUQF0pZPxRCXgqpocXtgwmkGFNwAqEtpjRODC1sW4h7DYHWbp-clEIZ96WPod_Dxzmc8x2-c-CcK4MLYPss-l_g9YLr6P4-qHtBEf0PxrXq-ms49crbpdLjk6sfP3rhC-feehVZ20ujWXDBG2Y3ESrM89Fke2sr8EJ_iFNkPVtcmIRwHIyG0SAvmrb29ofjbLLlB_twmuYX4GQ0v40g9xHkAwS5uXKZEnmWB1gTExocyxBcgwEEiaI4iwsUSgiAEyiM4KkmybNNghOoOirwjICTLMM1AAEwnkNJgmBovNmgAMpTBA8IjG00BYbnWJIHGAWaJM1wVJMHBA4Y7HjluRY7zUOsoOE4Wgb_XFkrPO6NhpP81fLbq60meqjE6qJtiZwpu1PLEjndUgxtuUOoqZhYIL0EM5ez0FGvE1kLI9shoD0k7KWNQQnFoGnM9UGyVMUR58vDQ1_KO1qcQi01VC8Rd32gtX0hBx3bxY1MXbiSuNOLFdsXvKUdc5GeHizUhFR79mhmJkpqSPOeYip8RxA5M8vdlkBalhxi6pIbGygZGramW099pJohGVPHIhaWRUJLFjsmZqVq0kvVRMk9oBk2mruGMNdMqdFrySmhpencXxRa0tUxEPfNdBjI7lK1XSJIhoeu1GhpEth1Mp90cbGtmIqkApsq_FhNW_Ic37S7aaR1RbFvh8DIUuhaZNe1udjsijMTE7mO3AMwNlwPVZb9DLheV4sgpsT9hMFVQeENR1wU8wygNPu2b-uYPbKl0diwGiZ0wkxzDlI1cbvBgMMtKc9tKeRgsW9kLfTBCBqOTnQsDeuLPvRFxbFScde1lV0Ys4UOeNLI0vA0dzOD03B7p2WRsum4AyMjirss-rJAFntB08M7vLXQs3ToiKFt2OmO0bEWepxSTkZgPdsfF32aoy90Wy-0IzuxIw_Yl4KBKJgg7fS6qaGYmnCz_Ile7PXyWQoFQUCSWJ0AJFMncBrWGz7Tr-O0hzKQxmifwO6VK8NRMIj8-6vIh6srKPJkFXntmVp1_cHXt36tPP_L1vfeu_3yD37rlO49s9UUBSzbEbMw4Pbl_uXOLqOMzy_TgSN4bDaz1YPu7hZBxjCSDi-S2-CoghxVKkcV5ajy6TuVtZPl9dJmmW-DxxXk2onSnbX_88VfqSL3P4XcOoUcnwLVNW_YH8OBH_m1swD0fQZl8DpDB2idAH2y3u_TTB3tewTuMZAJGHh8iqhWvBRG2aR27spm5O_lwyQYbG5f2Zxnkz3PK6IZTKfBZHP7q5t8G2y-cPXq1W-e_kTT3zxdevLs9Qc3jl96ePeR_OFzzx_ovnZ5QCv-VJhf8g6ngwizeWwyOC-TOES5DD80YtLIOSpPLt5aL72_Xrq58eeV6qhKlEol9ItC_Ic__un65z7z90Xvd7_6ytlv3b114y_RCfqH7Z-Fx8l6-fcfr629ZP304BsPr_-7t_zaRu2p6t6V9378kydR77H7tzOV8MG7_1r54PW9N868fObL33nxo3ezdz76-Y3TRz96dPs3f73bIr8f_OPzyJeQ2rPVMkwPaicEvinXhU6RBwOvdoLFSEri1dp9pFqGo1ntFwjLsixv2aGXaBPo2FNfOmBZlhN1dLJUnxZdEU4vxaQi7ItTknT8ZavNd5QZzSdklsgaFerzLIZwzjbx_aHC9wx7JgUs4coNpzsKBG9Eo5cX2HkpdRlxnIusO0QbMs1Oo0WXtqxwrtPxgCZRB2-f94Kk6fJjmo67JN1oa1BLGb2wEy77LEap8o4aNBldpbq-RJmx14hhVwmyA124eGejVl2fXXt48hC-KN9-453vnvps79vvb5SebByVr9VK_wE1%5Cu0026flow=fido%5Cu0026estsfed=1%5Cu0026uaid=983633a200c4f0000804faef5d212ac1%5Cu0026cobrandid=11bd8083-87e0-41b5-bb78-0bc43c8a8e8a%5Cu0026fci=00000003-0000-0ff1-ce00-000000000000%5Cu0026wsucxt=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoft.com/601ee552-4158-437a-9d8b-37c08a727d42/fido/get?uiflavor=Web</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/601ee552-4158-437a-9d8b-37c08a727d42/login</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/601ee552-4158-437a-9d8b-37c08a727d42/reprocess?ctx=rQQIARAAnVNbiBvnFdasNrJXtZNd1fSxl8WUYkfe-eeubf0wM5rLznpGmtFcpAnp9tfM7M5VGkujXUnGoZRAXChl_VAIfSmkhhQ3DyGQYEzBLYQmmNI4MSSwaSFukzYEGjt9clIKRe5LH0PPw8d3OOc7fOfAOVMG58DmafS_gdcXWEd3d0HdCxbsf2JUq66-gFPPv14qPTi-_MX9p7915nfXESosiny8ubEReKE_xCmyns3OjUM4CvJhNCjOecNsY2d3OMrGG36wCydpcQ6O8-kNBLmDIB8jyPWli5TIszzAmpjQ4FiG4BoMIEgUxVlcoFBCAJxAYQRPNUmebRKcQNVRgWcEnGQZrgEIgPEcShIEQ-PNBgVQniJ4QGBsoykwPMeSPMAo0CRphqOaPCBwwGBHS0-02EkRYgsYjqJ58M-llYXHnXw4Ln5efn251UQPlFidtS2RM2V3Ylkip1uKoc23CDUVEwukF2Dmchaa9zqRNTOyLQLaQ8Ke2xiUUAyaxlQfJHNVzDlfHh74UtHR4hRqqaF6ibjtA63tCwXo2C5uZOrMlcStXqzYvuDN7ZiL9HRvpiak2rPzfTNRUkOa9hRT4TuCyJlZ4bYE0rLkEFPn3MhAydCwNd165CPVDMmYOBYxsywSWrLYMTErVZNeqiZK4QHNsNHCNYSpZkqNXktOCS1Np_5soSVdHQNx30yHgezOVdslgmR44EqNliaBbSfzSRcX24qpSCqwqYUfq2lLnuObdjeNtK4o9u0QGFkKXYvsujYXm11x38REriP3AIwN10OVeT8DrtfVIogpcT9hcFVQeMMRZ4t5BlCafdu3dczObSkfGVbDhE6Yac5eqiZuNxhwuCUVhS2FHFzsG1kzfZBDw9GJjqVhfdGHvqg4Vipuu7ayDWN2oQOelFsanhZuZnAabm-1LFI2HXdgZMTiLrO-LJCLvaDp4R3emulZOnTE0DbsdMvoWDM9TiknI7Ce7Y8WfZqjz3RbX2hzO7EjD9gXgoEomCDt9LqpoZiacL38pd7qlfJpCgVBQJJYnQAkUydwGtYbPtOv47SHMpDGaJ_AbpcrwzwYRP6dZeST5SUUebiMvPBYrbp69wcb7ypP_qH1i3duPPfi-07p9mMbTVHAsi0xCwNuV-5f7GwzyujsPB04gsdm-7a6193eIMgYRtLBeXITHFaQw0rlsKIcVr56s7JyvLxaWi_zbfCgglw5Vrq58n---PNV5M5XkKMToLriDfsjOPAjv3YagL7PoAxeZ-gArROgT9b7fZqpo32PwD0GMgEDj04Q1YqXwigb185cWo_8nWKYBIP1zUvr02y843kLtg_TSTBe33xqnW-D9acvX778o5NfavpvT5YePn717rWjZ-_dui9_8sSTe7qvXRzQij8Rphe8g8kgwmweGw_OyiQOUS7DD4yYNAqOKpLzL6-WPlgtXV_7aKmaV4lSqYR-W4j_8tcPr37ja5_Oen_64_dO__jWy9f-Fh2jf9X-fXiUrJb__MXKyrPWb_Z-eO_qv3vz76_VHqluX3rnpdceRr0H7j9OVcK7b_9r6eNXdl499dyp7_70mc_fzt76_I1rJw9_ff_Ge3-_1SJ_GXz2TeQ7SO3xahmme7VjAt-U60JnkQcDr3aMxUhK4tXaHaRahvl-7U2EZVmWt-zQS7QxdOyJL-2xLMuJOjqeq4-KrggnF2JSEXbFCUk6_rzV5jvKPs0nZJbIGhXq0yyGcMo28d2hwvcMe18KWMKVG043DwQvp9GLM-yslLqMOCpE1h2iDZlmJ9GsS1tWONXpeECTqIO3z3pB0nT5EU3HXZJutDWopYy-sBPO-yxGqfKWGjQZXaW6vkSZsdeIYVcJsj1dOH9zrVZd3b9y7_gBfEa-8epbPzvx9d5PPlgrPVw7LF-plf4D0</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/601ee552-4158-437a-9d8b-37c08a727d42/resume?ctx=rQQIARAAnVNbiBvnFdasNrJXtZNd1fSxl8WUYkfe-eeubf0wM5rLznpGmtFcpAnp9tfM7M5VGkujXUnGoZRAXChl_VAIfSmkhhQ3DyGQYEzBLYQmmNI4MSSwaSFukzYEGjt9clIKRe5LH0PPw8d3OOc7fOfAOVMG58DmafS_gdcXWEd3d0HdCxbsf2JUq66-gFPPv14qPTi-_MX9p7915nfXESosiny8ubEReKE_xCmyns3OjUM4CvJhNCjOecNsY2d3OMrGG36wCydpcQ6O8-kNBLmDIB8jyPWli5TIszzAmpjQ4FiG4BoMIEgUxVlcoFBCAJxAYQRPNUmebRKcQNVRgWcEnGQZrgEIgPEcShIEQ-PNBgVQniJ4QGBsoykwPMeSPMAo0CRphqOaPCBwwGBHS0-02EkRYgsYjqJ58M-llYXHnXw4Ln5efn251UQPlFidtS2RM2V3Ylkip1uKoc23CDUVEwukF2Dmchaa9zqRNTOyLQLaQ8Ke2xiUUAyaxlQfJHNVzDlfHh74UtHR4hRqqaF6ibjtA63tCwXo2C5uZOrMlcStXqzYvuDN7ZiL9HRvpiak2rPzfTNRUkOa9hRT4TuCyJlZ4bYE0rLkEFPn3MhAydCwNd165CPVDMmYOBYxsywSWrLYMTErVZNeqiZK4QHNsNHCNYSpZkqNXktOCS1Np_5soSVdHQNx30yHgezOVdslgmR44EqNliaBbSfzSRcX24qpSCqwqYUfq2lLnuObdjeNtK4o9u0QGFkKXYvsujYXm11x38REriP3AIwN10OVeT8DrtfVIogpcT9hcFVQeMMRZ4t5BlCafdu3dczObSkfGVbDhE6Yac5eqiZuNxhwuCUVhS2FHFzsG1kzfZBDw9GJjqVhfdGHvqg4Vipuu7ayDWN2oQOelFsanhZuZnAabm-1LFI2HXdgZMTiLrO-LJCLvaDp4R3emulZOnTE0DbsdMvoWDM9TiknI7Ce7Y8WfZqjz3RbX2hzO7EjD9gXgoEomCDt9LqpoZiacL38pd7qlfJpCgVBQJJYnQAkUydwGtYbPtOv47SHMpDGaJ_AbpcrwzwYRP6dZeST5SUUebiMvPBYrbp69wcb7ypP_qH1i3duPPfi-07p9mMbTVHAsi0xCwNuV-5f7GwzyujsPB04gsdm-7a6193eIMgYRtLBeXITHFaQw0rlsKIcVr56s7JyvLxaWi_zbfCgglw5Vrq58n---PNV5M5XkKMToLriDfsjOPAjv3YagL7PoAxeZ-gArROgT9b7fZqpo32PwD0GMgEDj04Q1YqXwigb185cWo_8nWKYBIP1zUvr02y843kLtg_TSTBe33xqnW-D9acvX778o5NfavpvT5YePn717rWjZ-_dui9_8sSTe7qvXRzQij8Rphe8g8kgwmweGw_OyiQOUS7DD4yYNAqOKpLzL6-WPlgtXV_7aKmaV4lSqYR-W4j_8tcPr37ja5_Oen_64_dO__jWy9f-Fh2jf9X-fXiUrJb__MXKyrPWb_Z-eO_qv3vz76_VHqluX3rnpdceRr0H7j9OVcK7b_9r6eNXdl499dyp7_70mc_fzt76_I1rJw9_ff_Ge3-_1SJ_GXz2TeQ7SO3xahmme7VjAt-U60JnkQcDr3aMxUhK4tXaHaRahvl-7U2EZVmWt-zQS7QxdOyJL-2xLMuJOjqeq4-KrggnF2JSEXbFCUk6_rzV5jvKPs0nZJbIGhXq0yyGcMo28d2hwvcMe18KWMKVG043DwQvp9GLM-yslLqMOCpE1h2iDZlmJ9GsS1tWONXpeECTqIO3z3pB0nT5EU3HXZJutDWopYy-sBPO-yxGqfKWGjQZXaW6vkSZsdeIYVcJsj1dOH9zrVZd3b9y7_gBfEa-8epbPzvx9d5PPlgrPVw7LF-plf4D0</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/601ee552-4158-437a-9d8b-37c08a727d42/tlr/start</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/601ee552-4158-437a-9d8b-37c08a727d42/uxlogout</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/common/DeviceCodeStatus</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/common/GetCredentialType?mkt=en-US</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/common/GetOneTimeCode</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/common/PIA/EndAuth</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/common/debugmode</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/common/getrecoverycredentialtype?mkt=en-US</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/common/instrumentation/dssostatus</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/common/instrumentation/reportpageload</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/cookiesdisabled</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/forgetuser</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2f601ee552-4158-437a-9d8b-37c08a727d42%2freprocess%3fctx%3drQQIARAAnVNbiBvnFdasNrJXtZNd1fSxl8WUYkfe-eeubf0wM5rLznpGmtFcpAnp9tfM7M5VGkujXUnGoZRAXChl_VAIfSmkhhQ3DyGQYEzBLYQmmNI4MSSwaSFukzYEGjt9clIKRe5LH0PPw8d3OOc7fOfAOVMG58DmafS_gdcXWEd3d0HdCxbsf2JUq66-gFPPv14qPTi-_MX9p7915nfXESosiny8ubEReKE_xCmyns3OjUM4CvJhNCjOecNsY2d3OMrGG36wCydpcQ6O8-kNBLmDIB8jyPWli5TIszzAmpjQ4FiG4BoMIEgUxVlcoFBCAJxAYQRPNUmebRKcQNVRgWcEnGQZrgEIgPEcShIEQ-PNBgVQniJ4QGBsoykwPMeSPMAo0CRphqOaPCBwwGBHS0-02EkRYgsYjqJ58M-llYXHnXw4Ln5efn251UQPlFidtS2RM2V3Ylkip1uKoc23CDUVEwukF2Dmchaa9zqRNTOyLQLaQ8Ke2xiUUAyaxlQfJHNVzDlfHh74UtHR4hRqqaF6ibjtA63tCwXo2C5uZOrMlcStXqzYvuDN7ZiL9HRvpiak2rPzfTNRUkOa9hRT4TuCyJlZ4bYE0rLkEFPn3MhAydCwNd165CPVDMmYOBYxsywSWrLYMTErVZNeqiZK4QHNsNHCNYSpZkqNXktOCS1Np_5soSVdHQNx30yHgezOVdslgmR44EqNliaBbSfzSRcX24qpSCqwqYUfq2lLnuObdjeNtK4o9u0QGFkKXYvsujYXm11x38REriP3AIwN10OVeT8DrtfVIogpcT9hcFVQeMMRZ4t5BlCafdu3dczObSkfGVbDhE6Yac5eqiZuNxhwuCUVhS2FHFzsG1kzfZBDw9GJjqVhfdGHvqg4Vipuu7ayDWN2oQOelFsanhZuZnAabm-1LFI2HXdgZMTiLrO-LJCLvaDp4R3emulZOnTE0DbsdMvoWDM9TiknI7Ce7Y8WfZqjz3RbX2hzO7EjD9gXgoEomCDt9LqpoZiacL38pd7qlfJpCgVBQJJYnQAkUydwGtYbPtOv47SHMpDGaJ_AbpcrwzwYRP6dZeST5SUUebiMvPBYrbp69wcb7ypP_qH1i3duPPfi-07p9mMbTVHAsi0xCwNuV-5f7GwzyujsPB04gsdm-7a6193eIMgYRtLBeXITHFaQw0rlsKIcVr56s7JyvLxaWi_zbfCgglw5Vrq58n---PNV5M5XkKMToLriDfsjOPAjv3YagL7PoAxeZ-gArROgT9b7fZqpo32PwD0GMgEDj04Q1YqXwigb185cWo_8nWKYBIP1zUvr02y843kLtg_TSTBe33xqnW-D9acvX778o5NfavpvT5YePn717rWjZ-_dui9_8sSTe7qvXRzQij8Rphe8g8kgwmweGw_OyiQOUS7DD4yYNAqOKpLzL6-WPlgtXV_7aKmaV4lSqYR-W4j_8tcPr37ja5_Oen_64_dO__jWy9f-Fh2jf9X-fXiUrJb__MXKyrPWb_Z-eO_qv3vz76_VHqluX3rnpdceRr0H7j9OVcK7b_9r6eNXdl499dyp7_70mc_fzt76_I1rJw9_ff_Ge3-_1SJ_GXz2TeQ7SO3xahmme7VjAt-U60JnkQcDr3aMxUhK4tXaHaRahvl-7U2EZVmWt-zQS7QxdOyJL-2xLMuJOjqeq4-KrggnF2JSEXbFCUk6_rzV5jvKPs0nZJbIGhXq0yyGcMo28d2hwvcMe18KWMKVG043DwQvp9GLM-yslLqMOCpE1h2iDZlmJ9GsS1tWONXpeECTqIO3z3pB0nT5EU3HXZJutDWopYy-sBPO-yxGqfKWGjQZXaW6vkSZsdeIYVcJsj1dOH9zrVZd3b9y7_gBfEa-8epbPzvx9d5PPlgrPVw7LF-plf4D0%5Cu0026mkt=en-US%5Cu0026hosted=0%5Cu0026device_platform=Android</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://privacy.microsoft.com/en-US/privacystatement</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://signup.microsoft.com/signup?sku=teams_commercial_trial%5Cu0026origin=ests%5Cu0026culture=en-US</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.microsoft.com/en-US/servicesagreement/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://echdo365-my.sharepoint.com/personal/vlimon_echd_org/Documents/Attachments/Audit_Report_echd.org.xlsx</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_l_chUU-5ZYSVgQoZAiHKxw2.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_pzfy2abhlubh6bv_dyvwha2.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_lzfw9ovraljpmqc6m13khq2.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_iGr4o2yoBDyfwvXs2HIE3g2.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_fefa4e184d4076c9bb4f.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4bf24c4d450bd42ecb8f.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msftauth.net/shared/1.0/content/js/oneDs_36c085e9e54fe9d23a54.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msftauthimages.net/dbd5a2dd-gquzkcpgfutbzyjnpplp8vebdbavzszkfhtbvajkuvi/logintenantbranding/0/bannerlogo?ts=637838346661992232</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msftauthimages.net/dbd5a2dd-gquzkcpgfutbzyjnpplp8vebdbavzszkfhtbvajkuvi/logintenantbranding/0/illustration?ts=637838154765350354</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://autologon.microsoftazuread-sso.com/601ee552-4158-437a-9d8b-37c08a727d42/winauth/ssoprobe?client-request-id=9b3633a2-50ea-f000-0804-fc20d165e32f&amp;_=1787264035733</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&amp;content-type=application/x-json-stream&amp;w=2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://echdo365-my.sharepoint.com/personal/vlimon_echd_org/Documents/Attachments/Audit_Report_echd.org.xlsx#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://login.live.com/Me.htm?v=3</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/601ee552-4158-437a-9d8b-37c08a727d42/oauth2/authorize</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/601ee552-4158-437a-9d8b-37c08a727d42/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&amp;response%5Fmode=form%5Fpost&amp;ear%5Fjwe%5Fcrypto=eyJhbGciOiJFQ0RILUVTIiwiZW5jIjoiQTI1NkdDTSIsImFwdiI6IkFBQUFDVVZoY2tOc2FXVnVkR2dBQUFCRlEwc3pNQUFBQU1DWGtvcWQrYVFnTVdRWFhEZWlTbzlucldEVXNvamp2QXFNdVpIV1JSOC91RXFPT2kvS0xKaEpycSt6UWlkLzVOUHV4VEpRbWpPeVpHM0tjM1U4Y2dQTGhFS3kydnovOGtYRUYrWnZCRmRuYm5TQzM1Z2ZYOVR1SG9OUEhqaWx5Z0FBQUJqM3BDWkdDanBzNXd2SFZQbnlmRzJHdmUzTlptcWtIYVE9In0%3D&amp;ear%5Fjwk=eyJhbGciOiJFQ0RILUVTIiwiY3J2IjoiUC0zODQiLCJ4IjoiQUFBQU1NQ1hrb3FkK2FRZ01XUVhYRGVpU285bnJXRFVzb2pqdkFxTXVaSFdSUjgvdUVxT09pL0tMSmhKcnErelFpZC81QT09IiwieSI6IkFBQUFNTlB1eFRKUW1qT3laRzNLYzNVOGNnUExoRUt5MnZ6LzhrWEVGK1p2QkZkbmJuU0MzNWdmWDlUdUhvTlBIamlseWc9PSIsImt0eSI6IkVDIn0%3D&amp;spa%5Fclient%5Fid=08e18876%2D6177%2D487e%2Db8b5%2Dcf950c1e598c&amp;client%5Finfo=1&amp;response%5Ftype=code%20id%5Ftoken%20spa%5Frt&amp;resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&amp;scope=openid&amp;nonce=A360434FDFAE7521F7C9802C88A49C13E5915D627DDDD67C%2D838586F9C48CE1C8EFC03EEFDFE321CBA4EF7F90C529B4F845A5D1F82B52C8BB&amp;redirect%5Furi=https%3A%2F%2Fechdo365%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&amp;state=OD0wJjMyPUFBTHZuUUFBQUJRNzI4MlFkU1lLamZBU0pYSiUyRmI4aVo4VzV2aHRseENPMkdGaEJDbUNIVWtJUjBJNEZ4bE5wSUdGa1BWVjVkJTJGUVprWjdoJTJGaTdRUXF2OFNkcjdaJTJCWmJEZkx6JTJCWUtVRUxNZXdpTyUyQlhjdTVrTThWWXlSOEtBdXgzRUVoTEMxQUVNWGtwd09xdUdyU09NTCUyRkxhT1psWU5xR2FVRGxhJTJGbmVVcFVBRTJOcks1JTJGTWFVS1d3Nm91Z3V0UzhjNjFLc0FDelptJTJGSzUlMkJtVWljRzNIbWV0cFV3YjF6M2s1c3JiSSUyQlViWDdWUW5pMnJJSTZrMlJkWnglMkZlSThOMlg3aGtTYVhrR0pWVWQxZ0FxUlhlRGQ2c0VmVXF1bDVScmhGb3FNJTJCeFF2Qmgxd3lqZU01eWZwcW9aVFczbEhFVExHVU02Ym93Y1VrVDNUR0loWlBReU9uV0ZSZ0F1QnVpVlZYcTRCbUhzek5jNzNFdkxZTyUyQnp3dEg2NEhaclB0TSUyRmclM0QlM0Q&amp;claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&amp;wsucxt=1&amp;cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&amp;client%2Drequest%2Did=9b3633a2%2D50ea%2Df000%2D0804%2Dfc20d165e32f</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/601ee552-4158-437a-9d8b-37c08a727d42/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&amp;response%5Fmode=form%5Fpost&amp;ear%5Fjwe%5Fcrypto=eyJhbGciOiJFQ0RILUVTIiwiZW5jIjoiQTI1NkdDTSIsImFwdiI6IkFBQUFDVVZoY2tOc2FXVnVkR2dBQUFCRlEwc3pNQUFBQU1DWGtvcWQrYVFnTVdRWFhEZWlTbzlucldEVXNvamp2QXFNdVpIV1JSOC91RXFPT2kvS0xKaEpycSt6UWlkLzVOUHV4VEpRbWpPeVpHM0tjM1U4Y2dQTGhFS3kydnovOGtYRUYrWnZCRmRuYm5TQzM1Z2ZYOVR1SG9OUEhqaWx5Z0FBQUJqM3BDWkdDanBzNXd2SFZQbnlmRzJHdmUzTlptcWtIYVE9In0%3D&amp;ear%5Fjwk=eyJhbGciOiJFQ0RILUVTIiwiY3J2IjoiUC0zODQiLCJ4IjoiQUFBQU1NQ1hrb3FkK2FRZ01XUVhYRGVpU285bnJXRFVzb2pqdkFxTXVaSFdSUjgvdUVxT09pL0tMSmhKcnErelFpZC81QT09IiwieSI6IkFBQUFNTlB1eFRKUW1qT3laRzNLYzNVOGNnUExoRUt5MnZ6LzhrWEVGK1p2QkZkbmJuU0MzNWdmWDlUdUhvTlBIamlseWc9PSIsImt0eSI6IkVDIn0%3D&amp;spa%5Fclient%5Fid=08e18876%2D6177%2D487e%2Db8b5%2Dcf950c1e598c&amp;client%5Finfo=1&amp;response%5Ftype=code%20id%5Ftoken%20spa%5Frt&amp;resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&amp;scope=openid&amp;nonce=A360434FDFAE7521F7C9802C88A49C13E5915D627DDDD67C%2D838586F9C48CE1C8EFC03EEFDFE321CBA4EF7F90C529B4F845A5D1F82B52C8BB&amp;redirect%5Furi=https%3A%2F%2Fechdo365%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&amp;state=OD0wJjMyPUFBTHZuUUFBQUJRNzI4MlFkU1lLamZBU0pYSiUyRmI4aVo4VzV2aHRseENPMkdGaEJDbUNIVWtJUjBJNEZ4bE5wSUdGa1BWVjVkJTJGUVprWjdoJTJGaTdRUXF2OFNkcjdaJTJCWmJEZkx6JTJCWUtVRUxNZXdpTyUyQlhjdTVrTThWWXlSOEtBdXgzRUVoTEMxQUVNWGtwd09xdUdyU09NTCUyRkxhT1psWU5xR2FVRGxhJTJGbmVVcFVBRTJOcks1JTJGTWFVS1d3Nm91Z3V0UzhjNjFLc0FDelptJTJGSzUlMkJtVWljRzNIbWV0cFV3YjF6M2s1c3JiSSUyQlViWDdWUW5pMnJJSTZrMlJkWnglMkZlSThOMlg3aGtTYVhrR0pWVWQxZ0FxUlhlRGQ2c0VmVXF1bDVScmhGb3FNJTJCeFF2Qmgxd3lqZU01eWZwcW9aVFczbEhFVExHVU02Ym93Y1VrVDNUR0loWlBReU9uV0ZSZ0F1QnVpVlZYcTRCbUhzek5jNzNFdkxZTyUyQnp3dEg2NEhaclB0TSUyRmclM0QlM0Q&amp;claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&amp;wsucxt=1&amp;cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&amp;client%2Drequest%2Did=9b3633a2%2D50ea%2Df000%2D0804%2Dfc20d165e32f&amp;sso_reload=true</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/common/instrumentation/dssostatus</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/favicon.ico</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://privacy.microsoft.com/en-US/privacystatement</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.microsoft.com/en-US/servicesagreement/</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://echdo365-my.sharepoint.com/_forms/default.aspx&amp;state=OD0wJjMyPUFBTHZuUUFBQUJRNzI4MlFkU1lLamZBU0pYSiUyRmI4aVo4VzV2aHRseENPMkdGaEJDbUNIVWtJUjBJNEZ4bE5wSUdGa1BWVjVkJTJGUVprWjdoJTJGaTdRUXF2OFNkcjdaJTJCWmJEZkx6JTJCWUtVRUxNZXdpTyUyQlhjdTVrTThWWXlSOEtBdXgzRUVoTEMxQUVNWGtwd09xdUdyU09NTCUyRkxhT1psWU5xR2FVRGxhJTJGbmVVcFVBRTJOcks1JTJGTWFVS1d3Nm91Z3V0UzhjNjFLc0FDelptJTJGSzUlMkJtVWljRzNIbWV0cFV3YjF6M2s1c3JiSSUyQlViWDdWUW5pMnJJSTZrMlJkWnglMkZlSThOMlg3aGtTYVhrR0pWVWQxZ0FxUlhlRGQ2c0VmVXF1bDVScmhGb3FNJTJCeFF2Qmgxd3lqZU01eWZwcW9aVFczbEhFVExHVU02Ym93Y1VrVDNUR0loWlBReU9uV0ZSZ0F1QnVpVlZYcTRCbUhzek5jNzNFdkxZTyUyQnp3dEg2NEhaclB0TSUyRmclM0QlM0Q&amp;claims</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>aadcdn.msauth.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>aadcdn.msftauth.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>aadcdn.msftauthimages.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>autologon.microsoftazuread-sso.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>browser.events.data.microsoft.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>echdo365-my.sharepoint.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>login.live.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>login.microsoftonline.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>privacy.microsoft.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>www.microsoft.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>aadcdn.msauth.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>aadcdn.msauthimages.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>aadcdn.msftauth.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>account.live.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>echdo365-my.sharepoint.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>go.microsoft.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>login.live.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>login.microsoft.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>login.microsoftonline.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>passwordreset.microsoftonline.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacy.microsoft.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>signup.microsoft.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.microsoft.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>someone@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>13.107.246.45</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>20.190.159.75</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>20.190.160.64</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>23.55.163.133</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>40.126.31.0</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>52.168.117.171</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.107.136.10</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.55.163.133</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.52.181.141</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>72.246.29.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.55.163.132</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.190.159.75</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>88.221.169.152</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>40.126.31.0</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.190.160.64</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.190.160.130</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>40.126.32.6</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>13.107.246.45</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>3dfc00dcfa770e19621861546e37d4b670b6b37cc67ff54e0e32bb575e831d74</SHA-256>
              <SHA-1>3974b2ec0d731f947cff9472ec309c1b127e32de</SHA-1>
              <MD5>6b32ad1027e3dd6eafea280a3d0e1dc3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>46b3cb872f6fcc87838a91fb72fff67287d47595b4de85fd87536010044e072a</SHA-256>
              <SHA-1>1a3d0eba79fc46cfe0e22a76c9ec5c28f6ea9649</SHA-1>
              <MD5>7cec1e112c4e79dffe238bf2e7088ed5</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>4dfa468cc1b79429d47a904a788014de96b3b65387c87ad9f1c5f9867e840ca1</SHA-256>
              <SHA-1>e083589e3f70a40b6db44481731a701de21842bd</SHA-1>
              <MD5>3706cc26997dbb598c4ed41fdec4711a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>cd7ec135fef114802f126da2f48a4d9836cfc7db9125cac01c8388848c1193e2</SHA-256>
              <SHA-1>41fcbff7c177152c5f400b5391c35220d8e340df</SHA-1>
              <MD5>20d3994ac331ee949c160c887e26d43a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/jpeg</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>81102fed9b6e6c30b108c6f661eb99db2a026259edb5e59e008a3a63087c80c5</SHA-256>
              <SHA-1>edc5f4cb65699e20e259250ac57a9cd535f89940</SHA-1>
              <MD5>66b7c62f431e7b07aae3b894b1fdfc3d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>df2aa8537c1992c94846a0ffffaa9031d430d9d0210b9e396ec059aff62627e0</SHA-256>
              <SHA-1>bf0452e4a42a9af3b69d5d8c3a3a0433f14921b6</SHA-1>
              <MD5>75cf78d0e38c65a538ad253ca9e48dbe</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>2889d4b5ad04b598a26aec7e67e1359b76d822393c679f9e7fe57cbd9f5592d1</SHA-256>
              <SHA-1>32289edac51741513a08ec42282b096108b7334e</SHA-1>
              <MD5>f36a39a1817bb55c843ada5a09d7a4b3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>c8cef105fcaf7cbf3f8682c861045505c24d41cf6686c20c1c03e14031a3db69</SHA-256>
              <SHA-1>e933ca8534bcb6ad79d240316ce23c8b870050d0</SHA-1>
              <MD5>39a0eb35cd7799a181d34f4ae1ddb496</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>00000003-0000-0ff1-ce00-000000000000</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>08e18876-6177-487e-b8b5-cf950c1e598c</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>11bd8083-87e0-41b5-bb78-0bc43c8a8e8a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>51483342-085c-4d86-bf88-cf50c7252078</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>53ee284d-920a-4b59-9d30-a60315b26836</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>601ee552-4158-437a-9d8b-37c08a727d42</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>66f1668a-797b-4249-95e3-6c6651768c28</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>983633a2-00c4-f000-0804-faef5d212ac1</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>d62f60d3-2c4a-4fcc-9fd2-b887a7db5700</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://echdo365-my.sharepoint.com/personal/vlimon_echd_org/Documents/Attachments/Audit_Report_echd.org.xlsx</name>
        <report_id>4ad2d0ff-92c6-4773-83f1-71d812623c82</report_id>
        <tags>
          <value>html</value>
          <value>xml</value>
          <value>png</value>
          <value>jpg</value>
          <value>javascript</value>
          <value>aidetect</value>
          <value>phishing</value>
          <value>base64</value>
          <value>obfuscated</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0c5fbe047d6bcbe9177f4d2fff97640635ce886e01f18b7581460c5c9454884f</id>
    <title>Analysis Report for 0c5fbe047d6bcbe9177f4d2fff97640635ce886e01f18b7581460c5c9454884f</title>
    <updated>2026-08-20T22:13:23Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877c37f2677ae4d366d7f5</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877c025a70bef4cd1524d0</flow_id>
        <hash>0c5fbe047d6bcbe9177f4d2fff97640635ce886e01f18b7581460c5c9454884f</hash>
        <iocs>
          <urls>
            <value>
              <url>https://reanime.to/home</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://discord.com/invite/QsqcnsryyK</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w1280/2rmK7mnchw9Xr3XdiTFSxTTLXqv.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w1280/3Ku9HXFDzpohlL2rgGSOugeNP0a.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w1280/44cpdAd87SSmOVew1Y4LsEWjqPf.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w1280/7ZruEnSnHD6Jx5mF0hBt1E306Vt.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w1280/9HYL1EAUK9j5AIpiUk2leB3ur8W.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w1280/eJOy7YWAHgOS3V477sdTsq4v9jp.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w1280/j9fRIimor0AMFJR9kjZubXcABzZ.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w1280/o0NsbcIvsllg6CJX0FBFY8wWbsn.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w1280/z0YhJvomqedHF85bplUJEotkN5l.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w500/8QOnI8Xm1wGfbDR3AsM5bcz706.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w500/9F7daAmibx8ZHTE17CdM5FAwiHE.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w500/b4y5PKqoW21tjv4N0ZbzyGwzxJn.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w500/jJhNy9fEX6I7y4nCOdcMTs6pBDk.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w500/mAybxG37oAfGSnmJyBKfqbIHEec.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w500/pwlVxhX2ReQPXK4vu64vQROAmCY.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w500/w4XlIPu6YALsR1xg8ASUlCt7YlY.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w500/wNysocYhYIiCNI3SQBBTw0DTkWu.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.tmdb.org/t/p/w500/zinBf9ggTaUDUmhUvsuKlvmBdqZ.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://llvpn.com/tag.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://luugy.com/5/11123362/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://luugy.com/5/11123362/?oo=1&amp;js_build=iclick-v1.1889.0&amp;userId=0803989f16b245c5ec536ef0d95c2545&amp;dmn=llvpn.com&amp;tt=2&amp;ix=0&amp;tspl=729&amp;cslt=11</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://my.rtmark.net/gid.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/api/v1/community/top-posts?limit=5</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/api/v1/community/unread-count</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/api/v1/schedule?tz=UTC&amp;year=2026&amp;month=8</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/api/v1/top/anime?period=today&amp;limit=10</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/api/v1/user</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/apple-touch-icon.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/assets/0.CbQXTk5k.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/assets/AnimeCard.Dm4fi3iY.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/assets/AvatarFrame.BkaCuedQ.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/assets/ModPanel.CajS6d1v.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/assets/RankedName.BA8VAggs.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/assets/ScheduleWidget.DRvzXhDm.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/assets/UserBadges.BOtfb0tB.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/assets/input.DXi4jqmH.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/assets/nodes_17.CFaWC60P.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/assets/sonner.BKy7kTU7.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/-sbpb6AC.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/26cuyRlC.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/4R-CGQg3.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/B-cW28q_.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/B197Q6BF.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/B5fLZFWQ.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/BA0W6xvz.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/BDEArwzD.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/BEmMAPx9.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/BGstfFJ0.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/BJe5GsO-.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/BOZdi2oH.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/BQ1wcfwQ.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/BS81-YY0.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/Bb2EZKR-.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/BdN0itHi.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/Bem5rGe9.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/BkA1aQ2_.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/BljA7sYs.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/BlyDh6aq.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/Bp8tSEwU.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/BryvSuyb.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/Bsv6IG7K.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/BtDajnII.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/BwADKaJi.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/C0MYtaTs.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/C0Qzc7EJ.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/C0Yc_7e8.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/C0ljGILu.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/C237pPqR.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/C35_skxD.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/C4qOkBP3.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/C5FQZ4_T.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/C7Ckyqm9.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/CA_PMHiz.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/CCbskyZm.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/CE1G-McA.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/CJaA9CDc.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/COC1RzDb.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/CP-cU_qs.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/CP7CNma-.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/CR4sxWqX.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/CT-T3oDN.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/CU96FNQb.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/CW4LIxVO.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/CcBDq4HG.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/Cduj4Ghm.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/CelCSpYx.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/Cf7SE9hO.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/Cg7qw56y.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/CiNUDq06.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/Cir-_zmc.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/CixRBWZh.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/CkawDrLr.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/CmvX1aUZ.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/CpziOUqz.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/D8SGWMhO.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/D8aMGlIu.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/DBKR3Txj.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/DBcFNhl4.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/DLN3lS6z.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/DNx6pGmb.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/DOd573VN.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/DV7cWXjB.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/DVrkxfIT.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/DWXuaSH7.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/DboQ7iD8.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/DdqdE0HH.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/Demx0piZ.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/DlrOsR5O.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/DpdPAZHU.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/DqUCn0eD.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/DrZ14Xsc.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/Duah9Zxd.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/FZgO-jXA.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/GBNpObJj.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/IQ8F8E9y.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/LjidklXF.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/PPVm8Dsz.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/WubzpPRK.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/XqH3b5sS.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/YyxF3jfm.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/aP1Qy1jp.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/bg7Boudd.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/j4ZstMfW.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/lD5QBS5G.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/r12i5O_X.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/r6EhlxM0.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/skqUo_Cj.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/tLSsudjq.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/uZhZ0TFx.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/vAp0pgEN.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/w9N-ucSU.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/xsVgSQi5.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/chunks/ykPmaGvy.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/entry_app.DlV0RfpW.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/entry_start.CYwVJv-G.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/nodes_0.D-kIYG4_.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/nodes_1.l0wLKKvf.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/assets/immutable/nodes_17.BRn16COS.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/cdn-cgi/challenge-platform/h/g/jsd/oneshot/aae2b9a1c261/0.6108743719353918:1787259916:5nlHOcwWgGBkpMExpNXHheNAOBhra5TaJGT4xdur5ig/a2e4becccadb382a</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/cdn-cgi/challenge-platform/h/g/scripts/jsd/aae2b9a1c261/main.js?</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/cdn-cgi/rum?</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/cdn-cgi/speculation</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/home</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/home#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/logo.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/manifest.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://reanime.to/swetrix.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://restatus.me/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/banner/207141-MvHAS2YVfJzL.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/b204394-kwMsvF7s2bN8.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx101289-KXJbRU6TWA9N.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx107660-hgknnyaLchJW.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx108992-skuOsfmLmMd2.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx114194-uMuA92X6JHSj.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx166492-4INUf516qTuh.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx166522-pUnBSDFzs9DD.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx167991-uOu8ggPXzVUQ.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx174722-0FYs0b6zALL1.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx179845-9JEsAnvg8OKm.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx180136-gtMTCRlOD4OE.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx185646-2eGmsnaSHiLC.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx187166-ASfp7wErGrxQ.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx194389-DAbj4TOj5GB9.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx196187-0dgFi2CPp3xn.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx198376-sc5qcFv0RSH9.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx201667-oqaW97DQ7HUj.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx203880-lnruKftb27Nr.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx204466-vXMvIs4VOoQd.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx207141-h5q5KJPd6vaX.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx208044-Pm2UhvApQFUh.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx20819-w8PLekO22Sc8.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/bx21384-YR0hAau5UHAB.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s4.anilist.co/file/anilistcdn/media/anime/cover/medium/nx20724-2j5iN8ys949q.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cloudflareinsights.com/beacon.min.js/v4513226cdae34746b4dedf0b4dfa099e1781791509496</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.reddit.com/r/reanime</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>llvpn.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>discord.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>image.tmdb.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>llvpn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>luugy.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>my.rtmark.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>reanime.to</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>restatus.me</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>s4.anilist.co</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>static.cloudflareinsights.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.reddit.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.16.79.73</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.41.22</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>139.45.197.106</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.110.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.13.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>169.150.247.33</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>172.67.138.177</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>172.67.71.232</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>188.114.97.3</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxps://reanime.to/home</name>
        <report_id>655f22f4-687f-456c-a323-4f146fbfdbfa</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>27b521e776ee083bfdadc58df6ea8220acb7b0c94340124a00b0c3783ab050af</id>
    <title>Analysis Report for 27b521e776ee083bfdadc58df6ea8220acb7b0c94340124a00b0c3783ab050af</title>
    <updated>2026-08-20T22:12:14Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877bd2f2677ae4d366d7da</_id>
        <file_type>application/x-msdownload; format=pe64</file_type>
        <flow_id>6a877bbd009ae7a1a8d2f0ee</flow_id>
        <hash>27b521e776ee083bfdadc58df6ea8220acb7b0c94340124a00b0c3783ab050af</hash>
        <iocs>
          <ips>
            <value>
              <ip>5.1.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.230.217.38</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.21.226</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.20.226</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>5dda1b5ac9e2ced195fd9aa4f2f77addca3b01881d6b4fbeda17938084bcdcd4</SHA-256>
              <SHA-1>584ed45847d154afb679369dc896052db644aa8c</SHA-1>
              <MD5>5a06f07896f888ee91782222b3d15dd2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>989a7453d438236af7fce58fff13af8f81346a5d4bcb68e08400e549dcc9419a</SHA-256>
              <SHA-1>41cb4ee965ac039e0e8fc09efbd4f7dab6892bb6</SHA-1>
              <MD5>a775c908b6d8d92c4e6206f89de1c74a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>9d9f290527a6be626a8f5985b26e19b237b44872b03631811df4416fc1713178</SHA-256>
              <SHA-1>8e146c3c4e33449f95a49679795f74f7ae19ecc1</SHA-1>
              <MD5>edcfae989540fd42e4b8556d5b723bb6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c724cec6670876f586650503843a63a54a8a5222f3d69dee87931454bad67bce</SHA-256>
              <SHA-1>a808178663cfa2a22c22edf336f8e27b87b4ab84</SHA-1>
              <MD5>4b9c3904cc4b578713a3508a25f32420</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/vnd.ms-cab-compressed</file_type>
            </value>
            <value>
              <SHA-256>df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119</SHA-256>
              <SHA-1>9069ca78e7450a285173431b3e52c5c25299e473</SHA-1>
              <MD5>f1d3ff8443297732862df21dc4e57262</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>e3286b761c61d377ba343593a94e7a80659f12e40d4c1ddb46dfb3094e9cb2a4</SHA-256>
              <SHA-1>77ea923eed14c0eb4f56f88154eb58cd37545b6d</SHA-1>
              <MD5>8b4022b7820fa3d2638b05cacda73399</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>eaadcdd05a9a7c7f80d53d758f39e4399749d774b09a8a0165fe7c69ad6d8c3c</SHA-256>
              <SHA-1>0445b1735fd9797d537d360695940c7e68d25ace</SHA-1>
              <MD5>527eeaa35a23dd5cac9bddcc2561a457</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>52cdc6c5bb066f57298435db422962cccefe55f2e8edb762af20e7b04aa70194</SHA-256>
              <SHA-1>b562273eabb89644050a8d7864bfe2feb00bc448</SHA-1>
              <MD5>af69542cfc1d357816036072ed85c41c</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45</SHA-256>
              <SHA-1>b1ff3d48a3946ca7786a84e4a832617cd66fa3b9</SHA-1>
              <MD5>8fa52f316c393496f272357191db6deb</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <SHA-256>bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128</SHA-256>
              <SHA-1>8c015d80b8a23f780bdd215dc842b0f5551f63bd</SHA-1>
              <MD5>5bfa51f3a417b98e7443eca90fc94703</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/octet-stream</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>863b1b5ac3a0ec5597f60ddf3071d10c9960a98850c2b4f70c0b5109901813bd</SHA-256>
              <SHA-1>008956a58a1b1ada3d725b982588f072086acb8c</SHA-1>
              <MD5>c6082405b741e98693628dfe2f5163b9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\App Paths</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\RunOnce</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>System\CurrentControlSet\Control\Session Manager</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>System\CurrentControlSet\Control\Session Manager\FileRenameOperations</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>27b521e776ee083bfdadc58df6ea8220acb7b0c94340124a00b0c3783ab050af.exe</name>
        <report_id>622755ed-54d6-46ff-8ffd-9ec8291d517c</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>data</value>
          <value>fingerprint</value>
          <value>keylogger</value>
          <value>adaptive-context</value>
          <value>packed</value>
          <value>rundll32</value>
          <value>anti-debug</value>
          <value>stealer</value>
          <value>explorer</value>
          <value>installer</value>
          <value>lolbin</value>
          <value>reconnaissance</value>
          <value>runonce</value>
          <value>sfx</value>
          <value>autoit</value>
          <value>expired-cert</value>
          <value>CAB</value>
          <value>microsoft_visual_cc</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>7e3287b798f872724fd2f5236c761bc5891a7219f84bd7aa03664d15db4ef12a</id>
    <title>Analysis Report for 7e3287b798f872724fd2f5236c761bc5891a7219f84bd7aa03664d15db4ef12a</title>
    <updated>2026-08-20T22:09:25Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877b5cf2677ae4d366d7b8</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6a877b15eeadd95beca173e5</flow_id>
        <hash>7e3287b798f872724fd2f5236c761bc5891a7219f84bd7aa03664d15db4ef12a</hash>
        <iocs>
          <urls>
            <value>
              <url>file:///tmp/tmpmpy2hv3c.html</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <ips>
            <value>
              <ip>163.172.177.144</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>7c6da5e980e3c9191df401bb7460da55c204330be3b1f4b6afd2f5f41d8fcc3c</SHA-256>
              <SHA-1>2461c2294ea2789f9157b682b19358468648d3d1</SHA-1>
              <MD5>3f54e80d09e6121203bc303c001fc3f7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-rar-compressed; version=5</file_type>
            </value>
            <value>
              <SHA-256>0a087a0ab7eb3cfa171eaa960c65e9144e244d83c1b40f3e63faf13e77efee33</SHA-256>
              <SHA-1>d81d5994e05e4c2d89a32adccf543f305f3ce7f6</SHA-1>
              <MD5>bf473c73109d3e60cad6105499e0e0ff</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <SHA-256>ef30cae16ad11a37cd5ac135ec4279edbc81c06a6f8022d51c1504ca2c7e65b4</SHA-256>
              <SHA-1>c6dc406426982966801c04d63686eac684b131b0</SHA-1>
              <MD5>f34be1b57768c1e3a87f884321ab5248</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/html</file_type>
            </value>
            <value>
              <SHA-256>a2f13f3ce5e295f0ddac2d0a17955ecaafc565d7b6ab0047763d0af6988701ba</SHA-256>
              <SHA-1>efd409af70e1a7043316cf13aed0aadd96f357b1</SHA-1>
              <MD5>734570df94fb1ccc6eaa50778942b9d5</MD5>
              <origin>JAVASCRIPT_EMULATION</origin>
              <file_type>text/javascript</file_type>
            </value>
            <value>
              <SHA-256>d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49</SHA-256>
              <SHA-1>145c72f8acdcd366869f955dffd000d3bc146b6e</SHA-1>
              <MD5>7675b38aabebc8427171447edd484b5b</MD5>
              <origin>JAVASCRIPT_EMULATION</origin>
              <file_type>application/x-msdownload; format=pe32</file_type>
            </value>
            <value>
              <SHA-256>66c50d2a5ba0a96d30be3d64fcdf344912799375fcd093735824af43ab991e87</SHA-256>
              <SHA-1>3212975408dc753eaa6ceff270a107fafc862aeb</SHA-1>
              <MD5>f853f444a788183296e243a0af587288</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>submission.eml</name>
        <report_id>f71b321c-fafa-4700-82c1-905d258a57ea</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
          <value>html</value>
          <value>obfuscated</value>
          <value>anti-vm</value>
          <value>dropper</value>
          <value>evasive</value>
          <value>anti-debug</value>
          <value>packed</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f5936015ebd75be00518a323e4826e54372e8dc8e0401200ba24cf3e7f11bc39</id>
    <title>Analysis Report for f5936015ebd75be00518a323e4826e54372e8dc8e0401200ba24cf3e7f11bc39</title>
    <updated>2026-08-20T22:08:52Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877b0c49c2438a47b72be5</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877acf009ae7a1a8d2efdb</flow_id>
        <hash>f5936015ebd75be00518a323e4826e54372e8dc8e0401200ba24cf3e7f11bc39</hash>
        <iocs>
          <urls>
            <value>
              <url>https://odfwsk-zngp.maillist-manage.com/click/117788a8d6701869c/117788a8d66f62097</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <emails>
            <value>
              <email>name@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <btc_wallets>
            <value>
              <btc_wallet>x3928:$btc: 3RAD4zPJeAw1BvgdX3BaHzTZkk5pis</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>hxxps://odfwsk-zngp.maillist-manage.com/click/117788a8d6701869c/117788a8d66f62097</name>
        <report_id>567f0526-20a8-475a-ba95-af2619371ae3</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e034e5ce783ab71181be021896eda69d0bfc7fb59dd6c5cf4e0cd9fb3e2abce0</id>
    <title>Analysis Report for e034e5ce783ab71181be021896eda69d0bfc7fb59dd6c5cf4e0cd9fb3e2abce0</title>
    <updated>2026-08-20T22:08:46Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877b0749c2438a47b72be3</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877aebb107fd4d6e900cb5</flow_id>
        <hash>e034e5ce783ab71181be021896eda69d0bfc7fb59dd6c5cf4e0cd9fb3e2abce0</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.bansi.co.nz/chat/ChatGPT/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <emails>
            <value>
              <email>name@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <btc_wallets>
            <value>
              <btc_wallet>x3928:$btc: 3RAD4zPJeAw1BvgdX3BaHzTZkk5pis</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>hxxps://www.bansi.co.nz/chat/ChatGPT/</name>
        <report_id>5971377a-f4d0-49c6-91d7-f3a94cad2a0b</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e034e5ce783ab71181be021896eda69d0bfc7fb59dd6c5cf4e0cd9fb3e2abce0</id>
    <title>Analysis Report for e034e5ce783ab71181be021896eda69d0bfc7fb59dd6c5cf4e0cd9fb3e2abce0</title>
    <updated>2026-08-20T22:08:39Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877afeb4681b3ab7ee4858</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877ae6eeadd95beca17382</flow_id>
        <hash>e034e5ce783ab71181be021896eda69d0bfc7fb59dd6c5cf4e0cd9fb3e2abce0</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.bansi.co.nz/chat/ChatGPT/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <emails>
            <value>
              <email>name@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <btc_wallets>
            <value>
              <btc_wallet>x3928:$btc: 3RAD4zPJeAw1BvgdX3BaHzTZkk5pis</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>hxxps://www.bansi.co.nz/chat/ChatGPT/</name>
        <report_id>ac3e2107-9310-4786-843d-1d759db1a959</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9fe5fb74600e204a4739a0ed262f16ab6c7eb9f970f61d6315a8e5010f9bc3d4</id>
    <title>Analysis Report for 9fe5fb74600e204a4739a0ed262f16ab6c7eb9f970f61d6315a8e5010f9bc3d4</title>
    <updated>2026-08-20T22:08:31Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877b00f2677ae4d366d79d</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a877addeeadd95beca17377</flow_id>
        <hash>9fe5fb74600e204a4739a0ed262f16ab6c7eb9f970f61d6315a8e5010f9bc3d4</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>24099968e6750fa012485ab8c7f22f80bf8e133a099893a7726a22c26603b2e8</SHA-256>
              <SHA-1>3a5113cc5d0b814aa115257ca3d6d27d79e14c99</SHA-1>
              <MD5>f32fb1b6f8f612b61886d4cdf8a17069</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>3ac8f7519752b957391eb7fd849f189c98d4776f6db5dba2ff695c318bb8d250</SHA-256>
              <SHA-1>c4f87a24d3cc5f04ce7eba36c3288c7c236600a1</SHA-1>
              <MD5>99b78a6d60ad5bbba00abcda7c828118</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>6a78c0622687eae085945f24b3ab132e0e995d1d3329dbb04f0d8e1273ebf6fb</SHA-256>
              <SHA-1>3831bec2d44e864199e7b1be449e7313c55962f6</SHA-1>
              <MD5>548bd941e093c889a5ae7a3b3ace6ba4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>787ce1663a0821002a8f81762980a631b18508d4670990ea93b285f043b05bf9</SHA-256>
              <SHA-1>7ddeb1b7ef8fcd592927c672c62b392cf80d7458</SHA-1>
              <MD5>5c111e6f982848c2f9a63d17b816bb05</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>8241bdc2a181b30df7923f8a971ed1d8651aba3a7f92b2c0e1175879e5c7e454</SHA-256>
              <SHA-1>efd744e2ad7b8f1fb71d2ca865496b60d5774bd5</SHA-1>
              <MD5>fc86e3262da3c43f6464c6222fb6a0b3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>a7370b9224d35ecaba7006c72fd69d91383dd614efb531f3731088eadfba5847</SHA-256>
              <SHA-1>11912ad210fbd633d8533cfd8cb32972a454435c</SHA-1>
              <MD5>d6aef017df81b91cf894f5ad249ae636</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>c06f5bd42b0d87761f00dee7ff69b23c11afc469e093865c8e81db4e195c2ca5</SHA-256>
              <SHA-1>2e5d6f6eb75a89e5faa1a81b75962450e4d1c286</SHA-1>
              <MD5>7df91faa4045eb7842aded81610d3743</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>f46ba9047501d14c9eea66cf85fa710fcee518ddbfa2f5cd727310e0ddf2a9a9</SHA-256>
              <SHA-1>f9aa8c037558bf04442d5b9333fd53fd0f6c9ef1</SHA-1>
              <MD5>f79abe4dc01dd0d6064b6211957e0f45</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>1bb44a964c1547efa1c9e86f72c56b4910927b898568dcc37983034488d0eba0</SHA-256>
              <SHA-1>79afcaf993af7d66c83c5cb893383bbb9129764e</SHA-1>
              <MD5>1261d6a79f0a3a04212e9880b88fce2b</MD5>
              <origin>PE_EMULATION</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>32ded0a00a32a8c33e2a3294c9ea4a7cdf705e31967975bb237f938046b10df3</SHA-256>
              <SHA-1>324b3d659b86dfb5554182b52b37e9d7bf1f1cee</SHA-1>
              <MD5>104402d6cc15f4d29df1cb07e6fafd00</MD5>
              <origin>PE_EMULATION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
          <registry>
            <value>
              <registry>Software\Borland\Delphi\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\CodeGear\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\Embarcadero\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Delphi\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\CodeGear\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Embarcadero\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>UR.exe</name>
        <report_id>b1cf6161-bd78-4bbc-ade3-a7b25ba36610</report_id>
        <tags>
          <value>peexe</value>
          <value>keylogger</value>
          <value>packed</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>evasive</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>embarcadero_delphi</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>1462f3fba341b9e2582f21c5e286ec0f7d14d8c592f5dd49b67ce26bc11b8852</id>
    <title>Analysis Report for 1462f3fba341b9e2582f21c5e286ec0f7d14d8c592f5dd49b67ce26bc11b8852</title>
    <updated>2026-08-20T22:08:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877aec49c2438a47b72bde</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877ab4eeadd95beca172ff</flow_id>
        <hash>1462f3fba341b9e2582f21c5e286ec0f7d14d8c592f5dd49b67ce26bc11b8852</hash>
        <iocs>
          <urls>
            <value>
              <url>https://odfwsk-zngp.maillist-manage.com/click/117788a8d670177f8/117788a8d66f62098</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <emails>
            <value>
              <email>name@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <btc_wallets>
            <value>
              <btc_wallet>x3928:$btc: 3RAD4zPJeAw1BvgdX3BaHzTZkk5pis</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>hxxps://odfwsk-zngp.maillist-manage.com/click/117788a8d670177f8/117788a8d66f62098</name>
        <report_id>dc852537-c186-4cff-9741-22c37db04280</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f5936015ebd75be00518a323e4826e54372e8dc8e0401200ba24cf3e7f11bc39</id>
    <title>Analysis Report for f5936015ebd75be00518a323e4826e54372e8dc8e0401200ba24cf3e7f11bc39</title>
    <updated>2026-08-20T22:08:11Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877ae3b4681b3ab7ee4853</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877aca5a70bef4cd152401</flow_id>
        <hash>f5936015ebd75be00518a323e4826e54372e8dc8e0401200ba24cf3e7f11bc39</hash>
        <iocs>
          <urls>
            <value>
              <url>https://odfwsk-zngp.maillist-manage.com/click/117788a8d6701869c/117788a8d66f62097</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <emails>
            <value>
              <email>name@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <btc_wallets>
            <value>
              <btc_wallet>x3928:$btc: 3RAD4zPJeAw1BvgdX3BaHzTZkk5pis</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>hxxps://odfwsk-zngp.maillist-manage.com/click/117788a8d6701869c/117788a8d66f62097</name>
        <report_id>554a9249-24e8-427c-babb-dc85bad68f5d</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>170a3983f11de8ec4fae3376c58869a0bd032087c2c29f58c6ddf7a6ba23b9fb</id>
    <title>Analysis Report for 170a3983f11de8ec4fae3376c58869a0bd032087c2c29f58c6ddf7a6ba23b9fb</title>
    <updated>2026-08-20T22:07:58Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877ade49c2438a47b72bda</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877a9deeadd95beca172a7</flow_id>
        <hash>170a3983f11de8ec4fae3376c58869a0bd032087c2c29f58c6ddf7a6ba23b9fb</hash>
        <iocs>
          <urls>
            <value>
              <url>https://odfwsk-zngp.maillist-manage.com/click/117788a8d670177f8/117788a8d66f62099</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <emails>
            <value>
              <email>name@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <btc_wallets>
            <value>
              <btc_wallet>x3928:$btc: 3RAD4zPJeAw1BvgdX3BaHzTZkk5pis</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>hxxps://odfwsk-zngp.maillist-manage.com/click/117788a8d670177f8/117788a8d66f62099</name>
        <report_id>04b30379-f0eb-4d83-aba3-0bb86dc61f24</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>1462f3fba341b9e2582f21c5e286ec0f7d14d8c592f5dd49b67ce26bc11b8852</id>
    <title>Analysis Report for 1462f3fba341b9e2582f21c5e286ec0f7d14d8c592f5dd49b67ce26bc11b8852</title>
    <updated>2026-08-20T22:07:44Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877ac949c2438a47b72bd5</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877aaeeeadd95beca172e8</flow_id>
        <hash>1462f3fba341b9e2582f21c5e286ec0f7d14d8c592f5dd49b67ce26bc11b8852</hash>
        <iocs>
          <urls>
            <value>
              <url>https://odfwsk-zngp.maillist-manage.com/click/117788a8d670177f8/117788a8d66f62098</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <emails>
            <value>
              <email>name@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <btc_wallets>
            <value>
              <btc_wallet>x3928:$btc: 3RAD4zPJeAw1BvgdX3BaHzTZkk5pis</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>hxxps://odfwsk-zngp.maillist-manage.com/click/117788a8d670177f8/117788a8d66f62098</name>
        <report_id>5403c65b-636c-4ea6-8722-19a14894b427</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>170a3983f11de8ec4fae3376c58869a0bd032087c2c29f58c6ddf7a6ba23b9fb</id>
    <title>Analysis Report for 170a3983f11de8ec4fae3376c58869a0bd032087c2c29f58c6ddf7a6ba23b9fb</title>
    <updated>2026-08-20T22:07:21Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877aabf2677ae4d366d785</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877a98eeadd95beca17296</flow_id>
        <hash>170a3983f11de8ec4fae3376c58869a0bd032087c2c29f58c6ddf7a6ba23b9fb</hash>
        <iocs>
          <urls>
            <value>
              <url>https://odfwsk-zngp.maillist-manage.com/click/117788a8d670177f8/117788a8d66f62099</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <emails>
            <value>
              <email>name@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <btc_wallets>
            <value>
              <btc_wallet>x3928:$btc: 3RAD4zPJeAw1BvgdX3BaHzTZkk5pis</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>hxxps://odfwsk-zngp.maillist-manage.com/click/117788a8d670177f8/117788a8d66f62099</name>
        <report_id>0abffa3b-22cd-4add-a476-8ad50d7c8720</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ed8076b415d1dbff49bc0fae2813bc84e032c2ed5ed2d33939bb8cefcc5aad78</id>
    <title>Analysis Report for ed8076b415d1dbff49bc0fae2813bc84e032c2ed5ed2d33939bb8cefcc5aad78</title>
    <updated>2026-08-20T22:06:27Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877b18f2677ae4d366d7a4</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877a62009ae7a1a8d2ef14</flow_id>
        <hash>ed8076b415d1dbff49bc0fae2813bc84e032c2ed5ed2d33939bb8cefcc5aad78</hash>
        <iocs>
          <urls>
            <value>
              <url>https://github.com/Slourzz/Cloud/releases/tag/v2.6.6</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://api.github.com/cmc_internal/api</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://api.githubcopilot.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://archiveprogram.github.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://avatars.githubusercontent.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.github.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.github.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://docs.github.com/get-started/accessibility/keyboard-shortcuts</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.github.com/site-policy/github-terms/github-terms-of-service</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.github.com/site-policy/privacy-policies/github-privacy-statement</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github-cloud.s3.amazonaws.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.blog</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.blog/changelog</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/enterprise</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/enterprise/startups</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/features</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/features/actions</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/features/ai/github-app</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/features/code-quality</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/features/code-review</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/features/codespaces</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/features/copilot</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/features/issues</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/fluidicon.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/marketplace</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/mcp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/security/advanced-security</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/security/advanced-security/code-security</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/security/advanced-security/secret-protection</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/solutions</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/solutions/industry</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/solutions/industry/financial-services</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/solutions/industry/government</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/solutions/industry/healthcare</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/solutions/industry/manufacturing</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/solutions/industry/nonprofits</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/solutions/use-case</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/solutions/use-case/app-modernization</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/solutions/use-case/ci-cd</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/solutions/use-case/devops</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/solutions/use-case/devsecops</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/team</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/why-github</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.community/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/296-a42a557b17e98f4f.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/31721-f6f9b53de938591c.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/46740-fa2d6042e69cdff3.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/58494-041cd1803d1acff2.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/65637-accc4e9208dcd17e.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/78205-ee23aacea4530923.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/816-0618a896a22d101f.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/98944-d8943a5fe11b81d6.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/app-foundation-99df347becee37e6.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/app-runtime-0eca235714d29dcf.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/app-runtime.5ad24fa290b924ee.module.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/aria-live-50f912630c91395a.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/behaviors-51b403622ded57e2.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/catalyst-4cbc4856b6c4069d.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/dark-f6186b2d117410d4.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/dark_high_contrast-f39e8ef7b7418526.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/element-registry-2ee4648cde73d52f.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/environment-f235d5c019019ae9.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/fetch-utilities-7b6fb98f6a1b382e.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/github-a9a9110285537967.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/github-elements-44f210f747edb98d.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/global-d128fe951c35227f.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/high-contrast-cookie-076ad77dc53abb25.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/hotkey-d7eacd5a5172ab36.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/light-b18a1a7ee7730775.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/light_high_contrast-9d093cb5adfc6a5b.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/notifications-subscriptions-menu-05f44cfd1b558a93.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/primer-22bf543a61a1060e.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/primer-primitives-ae6d9799eadb7678.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/react-core-84bd63ce08defef5.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/relative-time-element-d82da87ed4cd5e62.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/releases-d37c970cd0384242.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/repositories-08429a7a0e3d7c31.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/repository-5c86d3f12914e4c9.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/runtime-helpers-199eecb878185733.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/selector-observer-68d21c8f08e4d02a.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.githubassets.com/assets/wp-runtime-22e69122f2cef911.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://maintainers.github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://private-user-images.githubusercontent.com/281519010/636592673-246b6c28-1f3c-4941-9d62-4efff8ccc990.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODcyNjM4ODcsIm5iZiI6MTc4NzI2MzU4NywicGF0aCI6Ii8yODE1MTkwMTAvNjM2NTkyNjczLTI0NmI2YzI4LTFmM2MtNDk0MS05ZDYyLTRlZmZmOGNjYzk5MC5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjYwODIwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI2MDgyMFQyMjA2MjdaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT02YzdkZmUzYjVkNmViY2U0N2EyZjg1N2U3YzkxMzVjZGE2ZGIxN2RkYjVjMDc5OGI2ODI2Yjg1NGE4M2I1MDdlJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZyZXNwb25zZS1jb250ZW50LXR5cGU9aW1hZ2UlMkZwbmcifQ.bKukEdfq_Fq-6QFzp4wLwK7RI9t9exbNjyBPxioAAeU</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://private-user-images.githubusercontent.com/281519010/636592807-e1725c77-b951-4835-860b-eac02c71f610.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODcyNjM4ODcsIm5iZiI6MTc4NzI2MzU4NywicGF0aCI6Ii8yODE1MTkwMTAvNjM2NTkyODA3LWUxNzI1Yzc3LWI5NTEtNDgzNS04NjBiLWVhYzAyYzcxZjYxMC5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjYwODIwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI2MDgyMFQyMjA2MjdaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT0yNzM2NDlhMzRmMTZhY2I5NGRhOTU1YmRiNTUyNjU5NGM4ZDk1MDA4YzZiYzg3YTk3YzA0MDJlM2I5MGFlOTU3JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZyZXNwb25zZS1jb250ZW50LXR5cGU9aW1hZ2UlMkZwbmcifQ.u1ezDfThDdNPEHV_LBaLg_04Ncf9b0zS47EKlOnCeIg</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://private-user-images.githubusercontent.com/281519010/636593029-5d125e2e-654d-405e-b21f-4a87632f8bcd.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODcyNjM4ODcsIm5iZiI6MTc4NzI2MzU4NywicGF0aCI6Ii8yODE1MTkwMTAvNjM2NTkzMDI5LTVkMTI1ZTJlLTY1NGQtNDA1ZS1iMjFmLTRhODc2MzJmOGJjZC5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjYwODIwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI2MDgyMFQyMjA2MjdaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1mN2IzNzg0ZTUwYTg2ODc2YTUyOTQ0MzJkZjJmZDhiYjA2MjBiMGE3OTM2ZmQ1OWEzMzEzYzhjN2RjM2Q1NjM5JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZyZXNwb25zZS1jb250ZW50LXR5cGU9aW1hZ2UlMkZwbmcifQ.tVEHp7--ab9CHAz44BwinpSMSRJiZK0LKLE9JXcPvtg</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://private-user-images.githubusercontent.com/281519010/636593053-47967d6e-fb17-41b5-b11c-adbbf4f25b06.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODcyNjM4ODcsIm5iZiI6MTc4NzI2MzU4NywicGF0aCI6Ii8yODE1MTkwMTAvNjM2NTkzMDUzLTQ3OTY3ZDZlLWZiMTctNDFiNS1iMTFjLWFkYmJmNGYyNWIwNi5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjYwODIwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI2MDgyMFQyMjA2MjdaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1mNGEzZTY2NDc5OGQyYmVjZWYxMGQwM2YxNWRjODMzMzVlODI5Y2MzOGMwYTMyZmI4MTE2MWFiOGI4MTUyOGM2JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZyZXNwb25zZS1jb250ZW50LXR5cGU9aW1hZ2UlMkZwbmcifQ.uuJrJL-NgqLtay4tFLHxWzxMn6yMX-Gt0iPS2g03K9g</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://private-user-images.githubusercontent.com/281519010/636593090-e650e676-c449-412a-a06b-e32161f0546a.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODcyNjM4ODcsIm5iZiI6MTc4NzI2MzU4NywicGF0aCI6Ii8yODE1MTkwMTAvNjM2NTkzMDkwLWU2NTBlNjc2LWM0NDktNDEyYS1hMDZiLWUzMjE2MWYwNTQ2YS5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjYwODIwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI2MDgyMFQyMjA2MjdaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1mZDg0MTFmNDczY2RjOGQxNTdkMWVkZTRiMjNjOWNhNWMwYTg4NzE3OThjMzBiMDg3YzEzOTRkNmVhMmFlNjJjJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZyZXNwb25zZS1jb250ZW50LXR5cGU9aW1hZ2UlMkZwbmcifQ.oplhptY09VnSibRyowrrRFbgGBbNiZEvMbBpW79Hnsc</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://private-user-images.githubusercontent.com/281519010/636593403-feb220a4-dde9-453c-9fab-ae415cfcfc59.gif?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODcyNjM4ODcsIm5iZiI6MTc4NzI2MzU4NywicGF0aCI6Ii8yODE1MTkwMTAvNjM2NTkzNDAzLWZlYjIyMGE0LWRkZTktNDUzYy05ZmFiLWFlNDE1Y2ZjZmM1OS5naWY_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjYwODIwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI2MDgyMFQyMjA2MjdaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1lYjA3ZDVjYzM1NThmZTYzY2M5MmJhNzBhNjZkYzdhZmVlMDY1MWRmOTAwYjhjYzM0ZTNlNmM5MWZhNGExYzA0JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZyZXNwb25zZS1jb250ZW50LXR5cGU9aW1hZ2UlMkZnaWYifQ.jy9-aAD0T2owC4NG516gejB1__XKXUkALwJ6s1BUtZo</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://private-user-images.githubusercontent.com/281519010/636593445-4e93981a-de75-4c94-ba60-a0e36663f80c.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODcyNjM4ODcsIm5iZiI6MTc4NzI2MzU4NywicGF0aCI6Ii8yODE1MTkwMTAvNjM2NTkzNDQ1LTRlOTM5ODFhLWRlNzUtNGM5NC1iYTYwLWEwZTM2NjYzZjgwYy5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjYwODIwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI2MDgyMFQyMjA2MjdaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT00OTA3MDcyODg3M2Y2ZTlhZmZjYWIzZWQ0ZDMxYTk2MDFiYzRlMzlmNTgyYmVhNDg2YjlkYmI3ZDkyZjRhZmZkJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZyZXNwb25zZS1jb250ZW50LXR5cGU9aW1hZ2UlMkZwbmcifQ.470WoSkFEzpl8Mcy4xdCN9PUM6GDoTzNMxMOOmT3lEA</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://private-user-images.githubusercontent.com/281519010/636593559-c0b085d3-6127-464f-82dd-4efb2407c83c.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODcyNjM4ODcsIm5iZiI6MTc4NzI2MzU4NywicGF0aCI6Ii8yODE1MTkwMTAvNjM2NTkzNTU5LWMwYjA4NWQzLTYxMjctNDY0Zi04MmRkLTRlZmIyNDA3YzgzYy5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjYwODIwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI2MDgyMFQyMjA2MjdaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT00YzQwMDcwOGM4YTE2NzQ1MjNhMmI5NmEyYjYxYzYzMDc5ODQ2MzJiYWFlMWJkYzljZDhhMjQwOTA1Mjk4ZTAxJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZyZXNwb25zZS1jb250ZW50LXR5cGU9aW1hZ2UlMkZwbmcifQ.HW51d0d8oDQQ7r9DgVAkkpz8amWU25RhEDbDSqC291Y</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://private-user-images.githubusercontent.com/281519010/636593607-d7573f66-87e3-464a-b41d-55baeff05806.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODcyNjM4ODcsIm5iZiI6MTc4NzI2MzU4NywicGF0aCI6Ii8yODE1MTkwMTAvNjM2NTkzNjA3LWQ3NTczZjY2LTg3ZTMtNDY0YS1iNDFkLTU1YmFlZmYwNTgwNi5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjYwODIwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI2MDgyMFQyMjA2MjdaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1kZWJjM2RkMjI4ZDczMWUyYTg4NTcwZjcxOGUzNmUzNGNlNzYzNjBkYjAxNjg5MzE0ZTQ3Y2E2NzFhZWE1ZGQ4JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZyZXNwb25zZS1jb250ZW50LXR5cGU9aW1hZ2UlMkZwbmcifQ._bm19iYxX6yWtTqRPoiI-hDftie5IDjpsmnhQs5IiYc</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://private-user-images.githubusercontent.com/281519010/636594005-58fd5a2c-c5c4-4ce2-acb5-4588b17be041.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODcyNjM4ODcsIm5iZiI6MTc4NzI2MzU4NywicGF0aCI6Ii8yODE1MTkwMTAvNjM2NTk0MDA1LTU4ZmQ1YTJjLWM1YzQtNGNlMi1hY2I1LTQ1ODhiMTdiZTA0MS5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjYwODIwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI2MDgyMFQyMjA2MjdaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT0zZTEzMzA5ZTliODEyOTRmNTNkYWZkNDU1ZjlhZmFhNjM3ZDY3MzM0MWJlODZmMDFhN2Y5MjI3MTcwN2QxOTI4JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZyZXNwb25zZS1jb250ZW50LXR5cGU9aW1hZ2UlMkZwbmcifQ.vNA6_3vECZm7lvCNNDt-HYQ-GLLqo2fOIcWkZY0jTng</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://private-user-images.githubusercontent.com/281519010/636594247-5a7c959c-8d60-4be6-bd0d-d3d8b0726588.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODcyNjM4ODcsIm5iZiI6MTc4NzI2MzU4NywicGF0aCI6Ii8yODE1MTkwMTAvNjM2NTk0MjQ3LTVhN2M5NTljLThkNjAtNGJlNi1iZDBkLWQzZDhiMDcyNjU4OC5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjYwODIwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI2MDgyMFQyMjA2MjdaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT0yZGU2ZTdkNWIxMzExNjk4Y2Y2ZWQ1MjUyM2Y5ODBkNmNlNGUxMTg2ZmFjOTViNWZlMDllYmIwNmMyODNlYjNiJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZyZXNwb25zZS1jb250ZW50LXR5cGU9aW1hZ2UlMkZwbmcifQ.n7Vo-E9PxMFHofHp_qaJfDS58DVkgqGmTrBuFRmfvpA</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://securitylab.github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://skills.github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://stars.github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.github.com?tags=dotcom-footer</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://user-images.githubusercontent.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.githubstatus.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>api.github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>api.githubcopilot.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>archiveprogram.github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>avatars.githubusercontent.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>docs.github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>github-cloud.s3.amazonaws.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>github.blog</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>github.community</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>github.githubassets.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>maintainers.github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>private-user-images.githubusercontent.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>securitylab.github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>skills.github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>stars.github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>user-images.githubusercontent.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.githubstatus.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>192.0.66.2</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.111.215</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.109.154</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.111.133</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.121.5</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>3.174.46.56</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.108.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.111.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.109.133</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.110.133</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.114.21</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.112.22</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>16.15.228.180</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.114.18</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.113.17</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.121.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>022a215ec47e633513e3c87c1bf18e85b9f4d0b3680026da870f31fbec179ac2</SHA-256>
              <SHA-1>7ed00dc9c9248cdd42c50f39d800f63a683b9112</SHA-1>
              <MD5>7108af3c0648ced632ffeea45585da18</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>109cdf32716fff68f275da0073c046bc6760e3df9ca1c3788c61b149dc4dab8c</SHA-256>
              <SHA-1>5990b42dfff1af6a36be7b7cbe7139306b5af16c</SHA-1>
              <MD5>f2a027220b91e846055bd88d16d48f4b</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>application/json</file_type>
            </value>
            <value>
              <SHA-256>3a8b985c93308cf5443c210abafab4f3403c09a3798ba392e498840cbae6d198</SHA-256>
              <SHA-1>d8c519c3a07c1add58d0d0dda805b8b230dd373a</SHA-1>
              <MD5>1efb87c5ffa0e9fd854839227c3cdcd2</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>4705cae3231d9364540dc8aa4d560e84af46f84dc1028b4fd100a7794fee7777</SHA-256>
              <SHA-1>9330c0ecd9050655cdc48635523ea9d2c25376d7</SHA-1>
              <MD5>22a47e5e8a96b824e0eaa751a2e2587b</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>application/json</file_type>
            </value>
            <value>
              <SHA-256>4794ad894244dfca727eabccd767961f2cd44d86ef899831bda42a19d33f3aee</SHA-256>
              <SHA-1>fa0b9802b6ba947349726d73de9a82329277c013</SHA-1>
              <MD5>24c6d680546807bb6991e38cb9d11598</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>application/json</file_type>
            </value>
            <value>
              <SHA-256>49cf2af3b8b908cad63aeae8c9eb3de48822fb5c71fad349f1665fe7b54161c9</SHA-256>
              <SHA-1>5bfeabde0cbe109afe88e4fc4b7bb995a90a6124</SHA-1>
              <MD5>bfa6ac440586884f963a1f39415d1ea8</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>4a728dae235aa7495d25cc0d9adead6f2d59b06e9a436e049d93d917732d898a</SHA-256>
              <SHA-1>8f68e0d37cc7afc6a4913570a29cb4eb754db1df</SHA-1>
              <MD5>b6d037c9501fb34ffcab2bab680fd61f</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>application/json</file_type>
            </value>
            <value>
              <SHA-256>4ca07e623edcc5fe94b1b5fc25a4aede472aa5d94d26b42760a7bf1f9d045025</SHA-256>
              <SHA-1>f4cc3ea73bfaf832e5f61d4f0d7555c08bfa44e2</SHA-1>
              <MD5>1cfd9d05639f7a6e595ada406b564c3d</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>5b335b23c837597c69a856209db648bc69eb45217694625670a4b53715bbacea</SHA-256>
              <SHA-1>4ab87bc39740f1cd8be6d03248f01e0c31f2dbf7</SHA-1>
              <MD5>a6d1e44ffb6adbe26d96dceaccfc469f</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>60b81ede67fe21e7fca4d957211c70fe21bf0908193db638cc64d8cfad78da77</SHA-256>
              <SHA-1>4092dd1ba6463305265038ca7edd5be27a70e20c</SHA-1>
              <MD5>cadd80d11c57b9ef5d2f5dfa728e27cf</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>application/json</file_type>
            </value>
            <value>
              <SHA-256>7bc8e47efb98ef265bb5e374f6cbe639f2b079e7a513a71d18f097990737cd33</SHA-256>
              <SHA-1>bd307128b76e27f66072cb19043c246394660480</SHA-1>
              <MD5>9ec9697916e19c82d15e70964e331b0c</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>7bc9f93d6a7cf2c8293d7277cbbd82ba48aaec4807b1c6e1897b610a904cfbf6</SHA-256>
              <SHA-1>09f887e4fa398cf876364c7c767dd3ab2db69b38</SHA-1>
              <MD5>bc7ff703194b11e3f3ad99454a148e4c</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>81a831f4cc3f8933305d0c1d7578a6117cad20bdf9068a4dfb118704b6ff0291</SHA-256>
              <SHA-1>8226def9c0447d71ce799941abb8e7a4234d5560</SHA-1>
              <MD5>054f889bc7d41c09549a84917ea48f19</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>a3ca15740485aa86880ac2ff573b8ebdb3791ce9d09dc82ec118f23d2478aec6</SHA-256>
              <SHA-1>ae2717494cd422a120b717623a23071e898cc150</SHA-1>
              <MD5>61b2bea5ce80b4224e717db5ec88048d</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>application/json</file_type>
            </value>
            <value>
              <SHA-256>abb53a4b4df0c9e9fa62a8966d106358174647bdd2bb45eb9bd2487c2604a809</SHA-256>
              <SHA-1>5274238e045065e81299d56e3da99c711c0562da</SHA-1>
              <MD5>f6b65245a70007d821de1c5a4ded2144</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>ad221de8e7f308dd654cd741659730baf1c0184df8fef3d4b325039ced774c14</SHA-256>
              <SHA-1>e6b76ecd1813dccf8ee57dfd3275ac81ed2c759f</SHA-1>
              <MD5>00edd5b12af638442f7260e052ae95de</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>application/json</file_type>
            </value>
            <value>
              <SHA-256>c6f23ccb47df58fbf290381c8260af3ccd5cd638632d11f2a7a2991b705bb295</SHA-256>
              <SHA-1>7763f1ffe874da854f8bd482bcca69be6e2fae28</SHA-1>
              <MD5>9748fd3dbd1940e6a59df173c42b7824</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>application/json</file_type>
            </value>
            <value>
              <SHA-256>da9b197b92ffeaa89632012e0e21af3cd3e05255369c6f02184468a0ffe2cce2</SHA-256>
              <SHA-1>f285b4378043d6ffab0c751b08913d58d2f88b84</SHA-1>
              <MD5>67993062dda6ca71057ed441b68dfa90</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>application/json</file_type>
            </value>
            <value>
              <SHA-256>df09a63a7667ae594a467e05d6815fe91d7f8ab6f3e3b5d03b94feb279527f8a</SHA-256>
              <SHA-1>ee0394fbaecf82d875b685c421e238f09265c1e6</SHA-1>
              <MD5>d85f1a3e6c545f9d822b2d72a8e66f5c</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>application/json</file_type>
            </value>
            <value>
              <SHA-256>e19b793516e05783c849c077f9d6df3a8517012b0bb84225403ec88b6e7c1baf</SHA-256>
              <SHA-1>5d727d9747083188efc74e2718328bfc5c6c68c4</SHA-1>
              <MD5>b244730ddb06a42fe00f3bfa4e44c2cd</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>application/json</file_type>
            </value>
            <value>
              <SHA-256>ecfa6fe175be0a43a0e2aad41ad727f45d011214c6383a0cc423301d0241113d</SHA-256>
              <SHA-1>cab658193e6fadf874374411dd49a35168737301</SHA-1>
              <MD5>5cbeb17bf3d719d9a057a35cec5e863a</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>f8303eadfe3df158372f105ea6ac0635cad560c7f125bb51541653189bca2c9b</SHA-256>
              <SHA-1>6b4fdce970598fa0931a6f92d7c5bb8819033d18</SHA-1>
              <MD5>ce705fc70aafa47e048d87a06e451217</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>113773e8e7e3e1b2aa0814766513d2d83f0c5f051d0e63e37dca60bdff33e54a</SHA-256>
              <SHA-1>914e84131a19f4237e5211b4a977fa64196c8474</SHA-1>
              <MD5>2bdbe7c402fd459487588c35ffe63ca7</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>ce12338f1caa233e296e0a2dc1d92f64f3673459cb63349991a9bd764eead5f6</SHA-256>
              <SHA-1>c01a0009daefe102d6fe4842543506d3fc064112</SHA-1>
              <MD5>36d185396dd1f59a188560537afc8014</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>4c0881554d40bfd2d8a772c66e90a61cc8f744be300e143126907b5008bef7ab</SHA-256>
              <SHA-1>a0a1b7c9aa833ee890444bd6e314f7820bd56261</SHA-1>
              <MD5>057964ffa168ceca753571e57a443252</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>48585b719192f73aefef0db863fa584d9086603113e7c8ac375b0f67904a7104</SHA-256>
              <SHA-1>dc67d99412a077621618a023911343e01f65df94</SHA-1>
              <MD5>054aace8c4cb84597aaf9344b8bbc90d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>01d85fca298b038b49fdaa5cb1c74fd50951c8dc9c0ada29941d079e15f0831d</SHA-256>
              <SHA-1>27fa94b52539f2359a209686ff8d2f91fd13d969</SHA-1>
              <MD5>0ca7c84ba07818d70c9fe2b422109a34</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>cc06ca29fb94a4b245b4e49872b6473f9fa28e9ae60a502515ebfe32ff1b51da</SHA-256>
              <SHA-1>90dc9b7cad6eded94b15e9cf2ae3323a0a4f067c</SHA-1>
              <MD5>8e88cd18bed4fb6dc2969ebf53939de9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>4d08b95f301aa92e0d3eacb3f30ea9094105be2a33bf3d0afd97e07219c1eda5</SHA-256>
              <SHA-1>223b515878d9235ca900a0e33bb79dfb38573d92</SHA-1>
              <MD5>0f58e3498285290d6ab42b677519c384</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>037fff7c-45ae-4e06-804d-5cae0b85b76b</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>04b8cb7c-f27b-4b27-ad6d-c592165f573d</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>1aaab186-e3f0-4b05-a1fb-6b852297938e</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>2148b856-16cc-41ac-824f-c541e98160d3</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>246b6c28-1f3c-4941-9d62-4efff8ccc990</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>3026ebb7-72b7-46d9-8310-79a0ecd79dbc</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>34d341cf-4adb-4728-9b76-75db8e34c465</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>34d37dec-7a35-3d8c-658b-5fc22d18e462</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>362a9607-d16e-4f96-a5ec-3dd50f6f518a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4429b83d-cd2e-4866-8e8e-89f28e9a61cd</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>47967d6e-fb17-41b5-b11c-adbbf4f25b06</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4bd29f92-4e77-4b3e-a939-f07e888f39ea</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4e1fe583-512d-4a78-8a7d-55a3ce67e7bf</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4e93981a-de75-4c94-ba60-a0e36663f80c</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>58fd5a2c-c5c4-4ce2-acb5-4588b17be041</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>5a7c959c-8d60-4be6-bd0d-d3d8b0726588</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>5d125e2e-654d-405e-b21f-4a87632f8bcd</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>7fe0113a-f2e5-4d7d-a376-2cf7c19cf9a3</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>bc999393-1159-4a48-9bea-223088d66474</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>c0b085d3-6127-464f-82dd-4efb2407c83c</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>c2cdca40-31c3-4d05-a254-ffa01a3ba21a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>d166b7b5-eeb8-4021-803e-9daac546d161</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>d7573f66-87e3-464a-b41d-55baeff05806</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e1725c77-b951-4835-860b-eac02c71f610</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e650e676-c449-412a-a06b-e32161f0546a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>f2a9478f-7c26-4376-88f0-95f6ec8c53ae</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>feb220a4-dde9-453c-9fab-ae415cfcfc59</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://github.com/Slourzz/Cloud/releases/tag/v2.6.6</name>
        <report_id>31476d3b-fa76-46e1-949c-2d168893be06</report_id>
        <tags>
          <value>html</value>
          <value>xml</value>
          <value>base64</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>3d6688f244fd5a43f19ee59f6ec03ea8b15b76459e62eae41e68e47a4e36343f</id>
    <title>Analysis Report for 3d6688f244fd5a43f19ee59f6ec03ea8b15b76459e62eae41e68e47a4e36343f</title>
    <updated>2026-08-20T22:05:37Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877aa5a7edcf8232f85e71</_id>
        <file_type>text/x-shellscript</file_type>
        <flow_id>6a877a2eeeadd95beca1713f</flow_id>
        <hash>3d6688f244fd5a43f19ee59f6ec03ea8b15b76459e62eae41e68e47a4e36343f</hash>
        <iocs>
          <urls>
            <value>
              <url>http://160.119.69.4/hima_data/index.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>http://45.95.147.178/hima_data/index.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>http://45.95.147.178/k.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>http://160.119.69.4/x</url>
              <origin>INPUT_FILE</origin>
              <verdict>MALICIOUS</verdict>
            </value>
          </urls>
          <ips>
            <value>
              <ip>160.119.69.4</ip>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>45.95.147.178</ip>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>160.119.69.4</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>aafb6699fffdb228f713f20a0c8134a4f33df08b173b86b74df0524938056d9e</SHA-256>
              <SHA-1>1f093ac32220550d917b5649dfa869c78b85483e</SHA-1>
              <MD5>8f03fe9b7cf53a715da9fb233400940e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/x-shellscript</file_type>
              <verdict>LIKELY_MALICIOUS</verdict>
            </value>
          </files>
        </iocs>
        <name>3d6688f244fd5a43f19ee59f6ec03ea8b15b76459e62eae41e68e47a4e36343f.sh</name>
        <report_id>5773b4df-4bfa-420f-8a57-6dd246e8d526</report_id>
        <tags>
          <value>shell</value>
          <value>base64</value>
          <value>obfuscated</value>
          <value>evasive</value>
          <value>bash</value>
          <value>lolbin</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>6a67763a829901183244ad096e6b1db260d0a9128004c8be3ddb89e1dafcee25</id>
    <title>Analysis Report for 6a67763a829901183244ad096e6b1db260d0a9128004c8be3ddb89e1dafcee25</title>
    <updated>2026-08-20T22:05:37Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877a9ba7edcf8232f85e6a</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6a877a315a70bef4cd152355</flow_id>
        <hash>6a67763a829901183244ad096e6b1db260d0a9128004c8be3ddb89e1dafcee25</hash>
        <iocs>
          <urls>
            <value>
              <url>https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>bugs.launchpad.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>keld@dkuug.dk</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>185.125.189.222</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>209.141.37.163</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>31.76.29.161</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <btc_wallets>
            <value>
              <btc_wallet>3748a1487727d43e75481841d25a1e86</btc_wallet>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>6a67763a829901183244ad096e6b1db260d0a9128004c8be3ddb89e1dafcee25.elf</name>
        <report_id>ec45d7b0-1d56-4687-b337-ad189aa21726</report_id>
        <tags>
          <value>elf</value>
          <value>mirai</value>
          <value>dropper</value>
          <value>gcc</value>
          <value>predictive-alin</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>de5748aac4a4d4cb48cf050652679e6bc49eda33d9ffaa0d280b578122fab55a</id>
    <title>Analysis Report for de5748aac4a4d4cb48cf050652679e6bc49eda33d9ffaa0d280b578122fab55a</title>
    <updated>2026-08-20T22:05:34Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877a73a7edcf8232f85e5b</_id>
        <file_type>application/x-mach-o-universal</file_type>
        <flow_id>6a877a2c5a70bef4cd15234c</flow_id>
        <hash>de5748aac4a4d4cb48cf050652679e6bc49eda33d9ffaa0d280b578122fab55a</hash>
        <iocs>
          <urls>
            <value>
              <url>http://www.apple.com/DTDs/PropertyList-1.0.dtd</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.rs/getrandom#nodejs-es-module-supportoffsettoo_many_continuationsnot</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>apple.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>docs.rs</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>17.253.144.10</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>151.101.65.91</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>16.15.14.13</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.19.18.17</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>ddb17d259447b422d85da3a545288adb696d499fd0080223cf8b3642e4630b2f</SHA-256>
              <SHA-1>0fb797d943161882753d755df20ac778befec2d1</SHA-1>
              <MD5>377db9a37a858df8ea2e06a27d0e4f1a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xml-dtd</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>f03f8890ad960cfba63cb389cf6b9c2a543806e858227dfe6b8e954f5eaa8c59</SHA-256>
              <SHA-1>1fa60387e6adc41d3567d02a92181db2a72156fa</SHA-1>
              <MD5>a9ba5c44aae5b059d52f0d195e569121</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>de5748aac4a4d4cb48cf050652679e6bc49eda33d9ffaa0d280b578122fab55a.macho</name>
        <report_id>aabc34db-103c-41eb-9cdf-2a667f1650a3</report_id>
        <tags>
          <value>html</value>
          <value>stealer</value>
          <value>expand</value>
          <value>lolbin</value>
          <value>base64</value>
          <value>predictive-alin</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>107ec2a0dfe9c1b42f5d0113e2e58fbecb138c721734c8d71d9cab0e9e8fd84f</id>
    <title>Analysis Report for 107ec2a0dfe9c1b42f5d0113e2e58fbecb138c721734c8d71d9cab0e9e8fd84f</title>
    <updated>2026-08-20T22:05:28Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877a9fa7edcf8232f85e6c</_id>
        <file_type>text/x-shellscript</file_type>
        <flow_id>6a877a26eeadd95beca1712b</flow_id>
        <hash>107ec2a0dfe9c1b42f5d0113e2e58fbecb138c721734c8d71d9cab0e9e8fd84f</hash>
        <iocs>
          <urls>
            <value>
              <url>http://160.119.69.4/hima_data/index.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>http://45.95.147.178/hima_data/index.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>http://45.95.147.178/k.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>http://160.119.69.4/x</url>
              <origin>INPUT_FILE</origin>
              <verdict>MALICIOUS</verdict>
            </value>
          </urls>
          <ips>
            <value>
              <ip>160.119.69.4</ip>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>45.95.147.178</ip>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>160.119.69.4</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>1c695c144dfae53c4f8edd20f56e7d4ae1ab73e95f516bc70d09769a6bf55faf</SHA-256>
              <SHA-1>f02f00a5a7b210a29a84259d2866bc4f051a5592</SHA-1>
              <MD5>e7b3f376fa14a14ea55017b9379198ea</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/x-shellscript</file_type>
              <verdict>LIKELY_MALICIOUS</verdict>
            </value>
          </files>
        </iocs>
        <name>107ec2a0dfe9c1b42f5d0113e2e58fbecb138c721734c8d71d9cab0e9e8fd84f.sh</name>
        <report_id>5ae86493-a284-4f8f-a6dc-d88f129a2821</report_id>
        <tags>
          <value>shell</value>
          <value>base64</value>
          <value>obfuscated</value>
          <value>evasive</value>
          <value>bash</value>
          <value>lolbin</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0f21cbab6fe36208f35eb24afdfc2092303cfcf10930e163058b0f93ee19b1e3</id>
    <title>Analysis Report for 0f21cbab6fe36208f35eb24afdfc2092303cfcf10930e163058b0f93ee19b1e3</title>
    <updated>2026-08-20T22:05:25Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877a88a7edcf8232f85e62</_id>
        <file_type>text/x-shellscript</file_type>
        <flow_id>6a877a2467502b6ca997af59</flow_id>
        <hash>0f21cbab6fe36208f35eb24afdfc2092303cfcf10930e163058b0f93ee19b1e3</hash>
        <iocs>
          <urls>
            <value>
              <url>https://debug.allllowef.space</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>debug.allllowef.space</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>138.124.70.84</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>0bf7f8c84606b822848984728013e03d2a05cee2c3580b79210bd70a37b8dbad</SHA-256>
              <SHA-1>6c4ac6eaac0010782b409946388cfd01de21cff8</SHA-1>
              <MD5>7566d51c5341a49c5e4baa71edbccbbc</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>0f21cbab6fe36208f35eb24afdfc2092303cfcf10930e163058b0f93ee19b1e3.sh</name>
        <report_id>cebc5861-7ce9-4b82-af58-0e7154974c7e</report_id>
        <tags>
          <value>html</value>
          <value>shell</value>
          <value>downloader</value>
          <value>stealer</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>46bf1133838ab89e06a9193f00084531f87fe50cb26e54c714f7a3c150050ef3</id>
    <title>Analysis Report for 46bf1133838ab89e06a9193f00084531f87fe50cb26e54c714f7a3c150050ef3</title>
    <updated>2026-08-20T22:05:22Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877a49a7edcf8232f85e4d</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6a877a21eeadd95beca1710f</flow_id>
        <hash>46bf1133838ab89e06a9193f00084531f87fe50cb26e54c714f7a3c150050ef3</hash>
        <iocs>
          <ips>
            <value>
              <ip>119.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>120.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>121.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
        </iocs>
        <name>46bf1133838ab89e06a9193f00084531f87fe50cb26e54c714f7a3c150050ef3.elf</name>
        <report_id>754024d6-500b-45e9-b122-66e26879b272</report_id>
        <tags>
          <value>elf</value>
          <value>mirai</value>
          <value>downloader</value>
          <value>predictive-alin</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>380d2e4917c852ca0e7aca605842ddd5bf443d77b2f2985391077a58bbf7d752</id>
    <title>Analysis Report for 380d2e4917c852ca0e7aca605842ddd5bf443d77b2f2985391077a58bbf7d752</title>
    <updated>2026-08-20T22:05:18Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877a40f2677ae4d366d766</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a877a1b009ae7a1a8d2ee73</flow_id>
        <hash>380d2e4917c852ca0e7aca605842ddd5bf443d77b2f2985391077a58bbf7d752</hash>
        <iocs>
          <ips>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>08b1dccfcd6daee8b4ce5911883ccf19b109a9840bc894fdab90c69f78455611</SHA-256>
              <SHA-1>e1ae24e2a53094f4b764408dc699ea52db7e8c4e</SHA-1>
              <MD5>6e274229d16396094d5974c8d77fcffc</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>0f8c998a08558c3f6a265b8ddf91550e6292c97623c419f4279f547d8ce65686</SHA-256>
              <SHA-1>7bb1ea1ee385a0ee321ca5a61ba4fd9af28b1dc5</SHA-1>
              <MD5>d29fa9b91570274082854b34c9899252</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>1dbd830c8af4cf28e2e4e753ecf25b9c4db061405e1f389dbc22415ae45636af</SHA-256>
              <SHA-1>f10b6104aff1d90033b444e3591c5200011777a0</SHA-1>
              <MD5>f2fb841858d71fc6d8f1d2d9fd31dab6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>2249cba38af99c88d37b4391dea92abfdfc5bc9f52af3b9bf68255396a9a4968</SHA-256>
              <SHA-1>ac937d2d760bfb902ca9adfaecfa8f20fc3ec0be</SHA-1>
              <MD5>e90260f7e5cbb543ff68713cac1dab1e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>43ae038b19cc3b23f66b54e0823df6927d2ee64b8abd4c4ff1ac39cda6426916</SHA-256>
              <SHA-1>22b60754a9d586012ac843f48b25681b041f4c0b</SHA-1>
              <MD5>55a0a633a4f1a58e0ecf624cba0dfae8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>4451462a5cecb56a67cf87588d8c6a22ceaa084abc7459b4915c17ef1bc95336</SHA-256>
              <SHA-1>3d7e66fe6736cbd4f0b10f1c4ae7bc410ec43bf4</SHA-1>
              <MD5>c6373226aa937ed302c4f85ec9f9fe24</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>6bb774dd3e4458b9b70cd199ee5b9f63a040c69e1bf2f3932e25a39da77f35f0</SHA-256>
              <SHA-1>3467494c92ad4740766ddedf74bb6e4f6ca05cea</SHA-1>
              <MD5>5e274e05ec921f17c5a107c43c2b53b5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>70e05c195f33d38fe51a2b03c33a66b156e1e559e369619ac71cbd71947fe6b5</SHA-256>
              <SHA-1>764bb53f36773c5cd4f40a80eb70e79beab5dd33</SHA-1>
              <MD5>5694c6e8594191458749aeb6786cea1e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>cc3390f4e2cd280c9f1dbe95a79757a83547acd64e23b1256ff34a4a53a50fda</SHA-256>
              <SHA-1>7ee4f2927389d74d54538dd814a1c3aad3af90ad</SHA-1>
              <MD5>7ab07b8dfff28f09f17c488cf959c8f2</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/zip</file_type>
            </value>
            <value>
              <SHA-256>dc0fd401ce88add5afd0709edfb35d780c741e0abb2d462f7926135fcea69d75</SHA-256>
              <SHA-1>5d2dcc124b82e4b847b7d9122667ecfede4b0225</SHA-1>
              <MD5>efb64361a5847e2be86a221c04791104</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>ff11ce01023eb542bed1f551dd83a811e0029f0bae931babbaa92655297a6a3d</SHA-256>
              <SHA-1>4bdb57932dc9ead8847ee75e1ae5da56caa5be4b</SHA-1>
              <MD5>02fb49b0ae6cd596e6822e965e441274</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>1496774759772c3c0ab8015bbc6d16ba87460eae23036881ba5943618ee922f4</SHA-256>
              <SHA-1>7029bcbfba86339defe2ce88b0075f91e052b952</SHA-1>
              <MD5>b044fc1fbde9b763128def25fe296b5a</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>28e122f37be5c3a46eaeb887b73a14a93c716982af1d458a01017d3e6c2d9c4d</SHA-256>
              <SHA-1>21a5c2020b2e993a454b525aecd848c62acd2bf8</SHA-1>
              <MD5>5377acc75b3bd234f46dd16d52fd91bc</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>ac98d1044068a2f8d0893b7f56576d5627750d430a59ba70ba1cff1087dd71c9</SHA-256>
              <SHA-1>b0542e26bf2abc8c9126f91567b9728250343e8e</SHA-1>
              <MD5>22e526e913cdadaf24d232bc111db6c8</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>image/jpeg</file_type>
            </value>
            <value>
              <SHA-256>f24168500a05628d241e8aa3fd6635304eff85c341f468de850ffd9bf497582b</SHA-256>
              <SHA-1>ac626b4af804df0cd7475e4f54c5780c457c9c5b</SHA-1>
              <MD5>6bc1be0aa86818c45917a1ef3f0be48f</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>23d1b065e921c17fca01c1366d7a27efa534ee73fe69ecba04e2d480ddc48a22</SHA-256>
              <SHA-1>f4d10cfeb2bf0f8888fed44c1a8e260a38abf882</SHA-1>
              <MD5>a008a971922437ce744e116a331aebd6</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>5ff295f0604219678f0b45594e82dc70a8af9fe7fde465317905d86d446018ce</SHA-256>
              <SHA-1>9c3cbba41924c531bceb9843ebbf94543524c52b</SHA-1>
              <MD5>6891d548f84cf82a453fecc9eceb3173</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>6303f205127c3b16d9cf1bdf4617c96109a03c5f2669341fbc0e1d37cd776b29</SHA-256>
              <SHA-1>b06feeac73d496c435c66b9b7ff7514cbe768d84</SHA-1>
              <MD5>75c1d7a3bdf1a309c540b998901a35a7</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>715e9b8d78e33e704eb42ae0d85d2f0f46c6fb9d0a89b00881ae754d85cae775</SHA-256>
              <SHA-1>fa49818b7be5c39d1b43fd087e4c489e9e558094</SHA-1>
              <MD5>3617368b179e75d6b3e0eb3a024c30a2</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>827cf96e430dcafceb08c3eb9a8a5d55027eb5668aff2751343622b574e4532b</SHA-256>
              <SHA-1>e1d1f7ff2363f443cca5a2ee846392856cb68942</SHA-1>
              <MD5>236b8cc5a768eeb2c3164993e0006f2b</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>88d14cc6638af8a0836f6d868dfab60df92907a2d7becaefbbd7e007acb75610</SHA-256>
              <SHA-1>04f73efb0801b18f6984b14cd057fb56519cd31b</SHA-1>
              <MD5>d8090aba7197fbf9c7e2631c750965a8</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>9b38e83f390723659d93ddbdba5f4d8fa4c746d6a9d193b85d5bd14040d89217</SHA-256>
              <SHA-1>18741565afd41bae2bff9951b04aaaaaab3ee778</SHA-1>
              <MD5>3d88f46a369c0be84a892da6cd43eb30</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>aa58f33f239a0fb02f5c7a6c45c043d7a9ac9a093335806694ecd6d4edc0d6a8</SHA-256>
              <SHA-1>13b1eab65a983c7a73bc7997c479d66943f7c6cb</SHA-1>
              <MD5>b06871f281fee6b241d60582ae9369b9</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>ba06dbd50c4c71fe8dd59c6b32362bf03bd4204cc05374aad8b6d7020a5d6e96</SHA-256>
              <SHA-1>637ec096fe8a91c3660477d33e9cde84001f0a74</SHA-1>
              <MD5>b8fa575e8082f4bc45bc6edb23130436</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>bf0f1a4d024bc5182071f27180224790824f002992dede28651c03d32237d46a</SHA-256>
              <SHA-1>8ea7d1e2d4be84887b1fb1bc57d3f194bf895c96</SHA-1>
              <MD5>dd16dc65cf64ddfc2181bb0c23ae7655</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>c6b6f34a88b36b07181dfdf70f1f37443b3c16cc03b21dc38e380dcdfcfc2d8b</SHA-256>
              <SHA-1>22bdf455e8a3b56fa68467d5188cd969ece7630b</SHA-1>
              <MD5>c4fb910dd0fc0a59d32efe54c697a59e</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>ce6b50dcb4bf928e156b9680207704b3ff1f5c4edc108d620b9d369e772a0c22</SHA-256>
              <SHA-1>991c897ba3ee282d678aa68d07490d99a46bd409</SHA-1>
              <MD5>34ba13d48af38da8ca2211b4bda92d7b</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>audio/mpeg</file_type>
            </value>
          </files>
        </iocs>
        <name>Setup.exe</name>
        <report_id>4c5f24d2-150d-4d31-830d-b0d676ee22fc</report_id>
        <tags>
          <value>peexe</value>
          <value>keylogger</value>
          <value>packer</value>
          <value>anti-debug</value>
          <value>overlay</value>
          <value>reconnaissance</value>
          <value>fingerprint</value>
          <value>packed</value>
          <value>expired-cert</value>
          <value>borland_delphi</value>
          <value>upx</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>13bfd20f627fe5a0e8a216a40492c5ae30045f41567f56e29cf587c076bd2abb</id>
    <title>Analysis Report for 13bfd20f627fe5a0e8a216a40492c5ae30045f41567f56e29cf587c076bd2abb</title>
    <updated>2026-08-20T22:05:02Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877a1bf2677ae4d366d75a</_id>
        <file_type>application/vnd.ms-outlook</file_type>
        <flow_id>6a877a0b1d88974f46c40b2c</flow_id>
        <hash>13bfd20f627fe5a0e8a216a40492c5ae30045f41567f56e29cf587c076bd2abb</hash>
        <iocs>
          <urls>
            <value>
              <url>https://nam10.safelinks.protection.outlook.com/</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity.microsoft.com%2FuserSubmissionsReportMessage&amp;data=05%7C02%7CHelpDesk%40antamina.com%7C0c694695ee5c426624c408deff01e044%7C81d621751b4e4e3eab079155ea9063ab%7C1%7C0%7C639228580716692206%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=h5JB75EzLnMNxsG5tPs4bV%2B9a3RgVEj%2FrYscdP3QsAg%3D&amp;reserved=0</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>antamina.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://security.microsoft.com/userSubmissionsReportMessage&amp;data=05</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>antamina.com</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://security.microsoft.com/userSubmissionsReportMessage&amp;data=05</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://schema.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://nam10.safelinks.protection.outlook.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity.microsoft.com%2FuserSubmissionsReportMessage&amp;data=05%7C02%7CHelpDesk%40antamina.com%7C0c694695ee5c426624c408deff01e044%7C81d621751b4e4e3eab079155ea9063ab%7C1%7C0%7C639228580716692206%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=h5JB75EzLnMNxsG5tPs4bV%2B9a3RgVEj%2FrYscdP3QsAg%3D&amp;reserved=0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://substrate.office.com/weveb2/api/v1.0/me/insights/findrelevantinsights</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>nam10.safelinks.protection.outlook.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>nam10.safelinks.protection.outlook.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schema.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>substrate.office.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>A_AdministraciondePersonal@antamina.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>CH3PR10MB74932C2A663D117603C35DB1A3CE2@CH3PR10MB7493.namprd10.prod.outlook.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>DS3PR10MB99770180A866B0DDECDD6EB74ABCCA2@DS3PR10MB997701.namprd10.prod.outlook.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>DS3PR10MB997701BF9E832493477811957ABCD82@DS3PR10MB997701.namprd10.prod.outlook.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>IA3PR10MB8066FA3952482BBC6676F926D4CC2@IA3PR10MB8066.namprd10.prod.outlook.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>PH5PR10MB997709B9BE7AE8A84894B87733BCD92@PH5PR10MB997709.namprd10.prod.outlook.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>RCarrion@antamina.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>dtorresb@antamina.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>0C391B70043A124DB5EB78EC37DE459B@DS3PR10MB997701.namprd10.prod.outlook.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>A_AdministraciondePersonal@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>A_ConcentrMetalurgia@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>A_ConcentrSupervisionSeniorLabQuimico@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>CH3PR10MB74932C2A663D117603C35DB1A3CE2@CH3PR10MB7493.namprd10.prod.outlook.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>ConcentratorMetallurgists@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>ConcentratorSeniorSupervisors@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>DS3PR10MB99770180A866B0DDECDD6EB74ABCCA2@DS3PR10MB997701.namprd10.prod.outlook.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>DS3PR10MB997701BF9E832493477811957ABCD82@DS3PR10MB997701.namprd10.prod.outlook.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>Exch_JefaturaPersonal@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>HelpDesk@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>IA3PR10MB8066FA3952482BBC6676F926D4CC2@IA3PR10MB8066.namprd10.prod.outlook.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>JMR.00000000-0000-0000-0000-000000000000.Junk.639228580654695695@microsoft.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>PH5PR10MB997709B9BE7AE8A84894B87733BCD92@PH5PR10MB997709.namprd10.prod.outlook.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>RCarrion@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>alopezv@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>assaylab@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>ciberseguridadmonitoreo@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>dpomalaza@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>dtorresb@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>image001.jpg@01DD1C56.2A107630</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>image002.png@01DD1DAC.6FCFE960</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>jachancaray@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>jcoaguila@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>jedquen@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>jperezg@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>jrecuay@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>manpower.ecalderon@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>mtafur@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>mzorogastua@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>phishingreport@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>pipelineteam@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>rcarrion@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>rchacpa@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>rescajadillo@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>vpajuelo@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>A_AdministraciondePersonal@antamina.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>CH3PR10MB74932C2A663D117603C35DB1A3CE2@CH3PR10MB7493.namprd10.prod.outlook.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>DS3PR10MB99770180A866B0DDECDD6EB74ABCCA2@DS3PR10MB997701.namprd10.prod.outlook.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>DS3PR10MB997701BF9E832493477811957ABCD82@DS3PR10MB997701.namprd10.prod.outlook.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>IA3PR10MB8066FA3952482BBC6676F926D4CC2@IA3PR10MB8066.namprd10.prod.outlook.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>PH5PR10MB997709B9BE7AE8A84894B87733BCD92@PH5PR10MB997709.namprd10.prod.outlook.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>RCarrion@antamina.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>dtorresb@antamina.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>132.184.129.16</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>132.184.55.150</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>151.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>255.255.255.255</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>52.102.113.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>52.98.252.226</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>51d547cb48265b7e0d91381f13427a0c2539d0b81ea11215482b764c70db8355</SHA-256>
              <SHA-1>bd89dd25896ab5e96dd4fa1cfdbbed8af066e7de</SHA-1>
              <MD5>14c144b3f2122c08b36b5b0a4aa43f81</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>message/rfc822</file_type>
            </value>
            <value>
              <SHA-256>f69ec9c7d598b2859ac983ef6adb3a865e7037b097cbc06d8f32582679309483</SHA-256>
              <SHA-1>15b9c0c456b6a113d34bb53c0df25423f6db277c</SHA-1>
              <MD5>504ae2e068b4f2f58f27804a5db9b9ba</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>7c41b898c5da0cfa4aa049b65ef50248bce9a72d24bef4c723786431921b75aa</SHA-256>
              <SHA-1>10588307553e766ab3c7d328d948dc6754893cef</SHA-1>
              <MD5>825644f747baab2c00e420dbbc39e4b3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>00000000-0000-0000-0000-000000000000</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>0c694695-ee5c-4266-24c4-08deff01e044</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>2b813f98-e322-49cb-9ff6-52fd9d324ac7</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>2f57b938-9a89-45d0-9780-90e2825c0571</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>397c27a2-fad7-46bd-a4bf-45cc6cc89bf3</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>3f0a4969-053e-44be-9931-ca62d0c32bde</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4b4fa35a-6f0f-194a-9956-5da44c1a6dee</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>81d62175-1b4e-4e3e-ab07-9155ea9063ab</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>91411f27-198f-491b-b4ab-1b6d2661a4bf</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>ba91229d-2dc4-4fe6-e480-08deff01dfd0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>c0cedde9-e37e-45d8-9861-b9eb586e6a71</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>f1cd6182-5a57-432c-ae7c-cbea54a5091c</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>Junk00000000-0000-0000-0000-000000000000RCarrion@antamina.com(Re Reintegro excepcional por conceptos pendientes de pago  Planilla de julio 2026) 8202026 92745 PM.msg</name>
        <report_id>f140def8-d235-463d-a559-e8ca77a00b91</report_id>
        <tags>
          <value>msg</value>
          <value>ole</value>
          <value>html</value>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>45ff87d3ab3cb35d8f47c673b5bc24c91356f554da79819706fc2d1f91c7e72b</id>
    <title>Analysis Report for 45ff87d3ab3cb35d8f47c673b5bc24c91356f554da79819706fc2d1f91c7e72b</title>
    <updated>2026-08-20T22:02:01Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877979f2677ae4d366d72e</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877958009ae7a1a8d2ecc6</flow_id>
        <hash>45ff87d3ab3cb35d8f47c673b5bc24c91356f554da79819706fc2d1f91c7e72b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://anikoto.cz/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/AnikotoTheme/assets/css/style.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/AnikotoTheme/assets/images/favicon.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/AnikotoTheme/assets/images/index-bg.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/AnikotoTheme/assets/images/logo.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/AnikotoTheme/assets/images/space-bg.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/anikoto/images/favicon.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/anikoto/manifest.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/home</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/watch/bleach-yaa9n</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/watch/demon-slayer-kimetsu-no-yaiba-infinity-castle-4tmun</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/watch/mushoku-tensei-jobless-reincarnation-season-3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/watch/naruto-shippuden-c8gov</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/watch/one-piece-odmau</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/watch/sakamoto-days-sfdxz</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/watch/solo-leveling-ilh08</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/watch/solo-leveling-season-2-arise-from-the-shadow-3eukp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/watch/that-time-i-got-reincarnated-as-a-slime-season-4-0u851</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/watch/wistoria-wand-and-sword-season-2-dua04</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdnjs.cloudflare.com/ajax/libs/Swiper/5.4.4/css/swiper.min.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/fa-solid-900.woff2</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://cdnjs.cloudflare.com/ajax/libs/tooltipster/4.0.0/css/tooltipster.bundle.min.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Bebas+Neue&amp;family=Nunito:wght@400;500;600;700&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/nunito/v32/XRXV3I6Li01BKofINeaB.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://llvpn.com/tag.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://luugy.com/5/11491115/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://luugy.com/5/11491115/?oo=1&amp;js_build=iclick-v1.1889.0&amp;userId=080398e84f8b4a16e91d64df5bdcd6e6&amp;dmn=llvpn.com&amp;tt=2&amp;ix=0&amp;tspl=572&amp;cslt=6</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://my.rtmark.net/gid.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://nekostream.site/065e62ec90168c435ef226daedc8a572.js?h=2026082022</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://nekostream.site/mt/1.js?1.20</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>llvpn.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://anikoto.cz/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/AnikotoTheme/assets/css/style.css</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://anikoto.cz/AnikotoTheme/assets/images/favicon.png</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://anikoto.cz/anikoto/manifest.json</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://anikoto.cz/filter?keyword=%7Bkeyword%7D</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://anikoto.cz/home</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://anikoto.cz/watch/bleach-yaa9n</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://anikoto.cz/watch/demon-slayer-kimetsu-no-yaiba-infinity-castle-4tmun</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://anikoto.cz/watch/mushoku-tensei-jobless-reincarnation-season-3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://anikoto.cz/watch/naruto-shippuden-c8gov</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/watch/one-piece-odmau</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/watch/sakamoto-days-sfdxz</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/watch/solo-leveling-ilh08</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/watch/solo-leveling-season-2-arise-from-the-shadow-3eukp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/watch/that-time-i-got-reincarnated-as-a-slime-season-4-0u851</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://anikoto.cz/watch/wistoria-wand-and-sword-season-2-dua04</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cdnjs.cloudflare.com/ajax/libs/Swiper/5.4.4/css/swiper.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cdnjs.cloudflare.com/ajax/libs/tooltipster/4.0.0/css/tooltipster.bundle.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Bebas+Neue&amp;family=Nunito:wght@400;500;600;700&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://nekostream.site/065e62ec90168c435ef226daedc8a572.js?h=$%7Bcachebuster%7D%60;</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://anikoto.cz/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>anikoto.cz</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>cdnjs.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>nekostream.site</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>anikoto.cz</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cdnjs.cloudflare.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>llvpn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>luugy.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>my.rtmark.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>nekostream.site</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.20.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.21.81.144</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.94</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.21.53.70</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.17.25.14</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.41.22</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.21.81.144</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>139.45.197.106</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.14.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>172.67.209.174</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>188.114.96.3</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.17.25.14</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>1cec66bfd0e8a2a3a113b8d875875675e26ad396f5f9286a154e88c1b8d323e1</SHA-256>
              <SHA-1>0d506bfbaadc1d95528ab5871be3cbc5801b8135</SHA-1>
              <MD5>f3eade6f5b0f0fd4a2b924edc8d65750</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>220bcb1ca2a00dad8195df3f900f82cab60fa423364e9d9aff31559947bf15ce</SHA-256>
              <SHA-1>8d52cf5d7815d3679d1cd8f326471edfe9fd9f34</SHA-1>
              <MD5>4ddcdb6a2d207dd0277856f0549bcf60</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>9bda38ce0a9e277736e2c0119a000abf395f2f1624907e31eae3e146b111bd01</SHA-256>
              <SHA-1>fa0ab1cb41cecd0b83e4bce74350c4b2a62be454</SHA-1>
              <MD5>833efb95d3107f1ba63144f4e18c8d85</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/json</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>47f8c211b6436f5eae9daa3e93efed675ab7c3ee0791b7aaac77b65a15784506</SHA-256>
              <SHA-1>136de11317acff9840c1a0ff61a1dbc16962136c</SHA-1>
              <MD5>5916095602ffbcfe0e5d0f4354e8d717</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>bfd1faff3a59a08d5f44a072e717d7af6e00b52641c344f6d1476feaf04d6fc7</SHA-256>
              <SHA-1>6715812d37718aba2d4012a8c59b9c8ebfa11cd2</SHA-1>
              <MD5>4e2a65d4373253b58f9426b4259cb95e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/css</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>bcd5336e93498d5809baff35e028bd45f8ec3c3b4f805a0008511eac552a0b4b</SHA-256>
              <SHA-1>e2c4b8ea9e19ad3caca3990455d720fddba286b5</SHA-1>
              <MD5>0d036edf302b74608b2ddd59c230243a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>96bfd78819fd01f2a7b302353144d0c84a16cdc0369d08db75359a534185facb</SHA-256>
              <SHA-1>677c12f5c5efc4f43c8b3fb56a1a62121c6aa7fd</SHA-1>
              <MD5>77e9dd4db92975792b56d1c87c7f9d4a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>bee0fd3cf632262d9498a784a576dc1d1acdfcf46bec297f045664ac51959082</SHA-256>
              <SHA-1>c939508bd47ab21bba66b9ddf679bc4d469875f1</SHA-1>
              <MD5>07bfa174734922d70cd2aa32b6bc2af2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>1acaf08e0b4fe68a9cfd62280a553624cc570a7cfd54181e055705150995d237</SHA-256>
              <SHA-1>9c8ef853a74aa356bbc52860064c5fc7b7e51bf7</SHA-1>
              <MD5>7d18f27de15ffd742a107cde1d9e0779</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>1ed5a115a99a91501a7ffcd3080b2bc240ab7e770893cbebe5f39d5beb94fa23</SHA-256>
              <SHA-1>5dd59efd1564c835b98658deb2bf3209f0c8670e</SHA-1>
              <MD5>5bb858bfcc46f2e552ae5ebfbd43bf09</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://anikoto.cz/</name>
        <report_id>59c39133-07ba-49ab-9006-886c10c29c7e</report_id>
        <tags>
          <value>html</value>
          <value>javascript</value>
          <value>png</value>
          <value>txt</value>
          <value>json</value>
          <value>captcha</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>3e01b0d0b5db83b26a4d11fbb65b03bd6e1c741d59a404697f4e7204dc1f3922</id>
    <title>Analysis Report for 3e01b0d0b5db83b26a4d11fbb65b03bd6e1c741d59a404697f4e7204dc1f3922</title>
    <updated>2026-08-20T21:59:30Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877913f2677ae4d366d719</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8778c0009ae7a1a8d2eade</flow_id>
        <hash>3e01b0d0b5db83b26a4d11fbb65b03bd6e1c741d59a404697f4e7204dc1f3922</hash>
        <iocs>
          <urls>
            <value>
              <url>https://animeowl.top/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://animeowl.top</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://animeowl.top/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/az-list/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://animeowl.top/comments/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://animeowl.top/contact-us/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://animeowl.top/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://animeowl.top/genre/action/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://animeowl.top/genre/animation/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://animeowl.top/genre/avant-garde/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/genre/comedy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/genre/drama/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/genre/erotica/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/genre/fantasy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/genre/historical/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/genre/horror/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/genre/idols-female/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/genre/isekai/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/genre/medical/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/genre/music/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/genre/mystery/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/genre/otaku-culture/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/genre/reality/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/search</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/search/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/wp-content/themes/animetheme/assets/kiranime-frontend.js?ver=v4104eng28s07s2025d1935-lhsdkjdsTUnd</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/wp-content/themes/animetheme/assets/style.css?ver=v4104eng28s07s2025d1935-lhsdkjdsTUnd</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/wp-content/themes/animetheme/core/helper/jsholder.js?ver=v4104eng28s07s2025d1935-lhsdkjdsTUnd</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/wp-content/uploads/2025/09/animeowl-icon.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/wp-includes/css/admin-bar.min.css?ver=6.9.4</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/wp-includes/css/dashicons.min.css?ver=6.9.4</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/wp-includes/css/dist/block-library/style.min.css?ver=6.9.4</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/wp-json/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://animeowl.top/xmlrpc.php?rsd</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Montserrat%3Awght%40300%3B400%3B500%3B600%3B700%3B800%3B900&amp;display=swap&amp;ver=v4104eng28s07s2025d1935-lhsdkjdsTUnd</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/icon?family=Material+Icons&amp;ver=v4104eng28s07s2025d1935-lhsdkjdsTUnd</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://reddit.com/submit</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://reddit.com/submit?url=https://animeowl.top&amp;title=AnimeOwl</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.w.org/images/core/emoji/17.0.2/72x72/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://s.w.org/images/core/emoji/17.0.2/svg/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://t.me/share/url</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://t.me/share/url?url=https://animeowl.top&amp;text=AnimeOwl</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://verticallysaturate.com/00/60/7f/00607ff6b47495eb1f120ae16ad35897.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/sharer.php</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/sharer.php?u=https://animeowl.top</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-GY4YYT5L59</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.tumblr.com/widgets/share/tool</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.tumblr.com/widgets/share/tool?canonicalUrl=https://animeowl.top&amp;title=AnimeOwl</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://x.com/intent/tweet</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://x.com/intent/tweet?url=https://animeowl.top&amp;text=AnimeOwl</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>animeowl.top</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>reddit.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>s.w.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>t.me</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>verticallysaturate.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.tumblr.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>x.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.20.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.0.77.40</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.21.26.51</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>149.154.167.99</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>157.240.253.35</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.111.84.124</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>151.101.1.140</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.0.77.48</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.66.0.227</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>220bcb1ca2a00dad8195df3f900f82cab60fa423364e9d9aff31559947bf15ce</SHA-256>
              <SHA-1>8d52cf5d7815d3679d1cd8f326471edfe9fd9f34</SHA-1>
              <MD5>4ddcdb6a2d207dd0277856f0549bcf60</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>686b702b29a5d6718c166cb7f4d482000711a8332ac53b17083b0af4b9010cb5</SHA-256>
              <SHA-1>40046ee93749d910350a94d76b2506ca7bdc39c9</SHA-1>
              <MD5>0a660db412a554c77c508cc36c7f7e10</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>352c3a60b6d99cecba551cae9336024044257dfa7a9c09638e7319e829758ecf</SHA-256>
              <SHA-1>04a7b1b1b7b9b0aeddeabcb0a28f0579b9d5169a</SHA-1>
              <MD5>b806eba4d8624a942934505ca50945b2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>9f3a583a3d76b13b2e541d7b9eceef22f81dd30426f486941f17a60bc89e9a7d</SHA-256>
              <SHA-1>d2c175ce0ab0ad9008954c329250c88814609666</SHA-1>
              <MD5>792c02898274bb10414b9650cd3fa7ac</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>eacccde824265be13c44db64542c3322930574d2c754a5478b9c27106dbabce1</SHA-256>
              <SHA-1>283d55d8363091b4c2c3e9c1829e91363e6c9b94</SHA-1>
              <MD5>062b0d874fbe3615bbeeaf825f13498b</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>47d738829f8b3b0d48274e47a4940f61bda431b0838305d56ddb0190aa76229e</SHA-256>
              <SHA-1>5b60997aa100286ccfdd962bedb03aa15d8f8b98</SHA-1>
              <MD5>bddc792b778f9180e97a0da735d25295</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>1d13c9c0535a77604c3e05ae9adfa50eff78eb12b1593e8817ea162db33f7dfa</SHA-256>
              <SHA-1>23418fd2df9d4b39c86a2a77a9b8dd11621575e5</SHA-1>
              <MD5>bcd24a7a47d305922d7b370b7a416be8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>6090979cf61cf9965a8b07472e4090ae3483aa2d7593d0c214e5df163652a96b</SHA-256>
              <SHA-1>86ae6e0b89af72090c08160f421a711c5b1fc025</SHA-1>
              <MD5>8d26d2f3a6c83b823cea059a9bbf4f1c</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>0d037d0ac35111285f00289e1a929e539c278d4d47847b8e8059793d4ba0908a</SHA-256>
              <SHA-1>927331f261aa900ba4de828e75d2f6c3b786bcb2</SHA-1>
              <MD5>f90520ce8a94803be7864ed7ee493c24</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>x22efe:$btc: 3r4LYFuXrg3G8fepysr4xSLWnQ</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>hxxps://animeowl.top/</name>
        <report_id>8be5a262-4343-409a-9bdd-0f61e944139c</report_id>
        <tags>
          <value>html</value>
          <value>base64</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e224ca039f5b100e292774d17b9214db6f8ba532fef928434decbb1cbe9861eb</id>
    <title>Analysis Report for e224ca039f5b100e292774d17b9214db6f8ba532fef928434decbb1cbe9861eb</title>
    <updated>2026-08-20T21:56:35Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877857f2677ae4d366d6f8</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877811009ae7a1a8d2e88d</flow_id>
        <hash>e224ca039f5b100e292774d17b9214db6f8ba532fef928434decbb1cbe9861eb</hash>
        <iocs>
          <urls>
            <value>
              <url>https://maxmmp.net/w/gqvJPUkzi</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://i.ibb.co/TMBZ8Q8V/638f30765149.jpg</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://i.ibb.co/bMsLjgCT/b2a22abc2763.jpg</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>i.ibb.co</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>45.43.142.5</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>458c1bf2f49a7d06607a0a19997e0f56fe758812f59c563facc5807df18dede5</SHA-256>
              <SHA-1>e584b5be8d39db2df814087d30217c32963c471e</SHA-1>
              <MD5>a4fd5f003547e101bc73947ed383b830</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/jpeg</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://maxmmp.net/w/gqvJPUkzi</name>
        <report_id>cfea5eea-f35c-4891-b1cd-35b75e8fb0d5</report_id>
        <tags>
          <value>jpg</value>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0ae38ed87958a5fb1fb385a9ff2d4126cc590aa03fc14f0465427e57e12d5b51</id>
    <title>Analysis Report for 0ae38ed87958a5fb1fb385a9ff2d4126cc590aa03fc14f0465427e57e12d5b51</title>
    <updated>2026-08-20T21:56:13Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877815a7edcf8232f85dd4</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6a8777fb009ae7a1a8d2e846</flow_id>
        <hash>0ae38ed87958a5fb1fb385a9ff2d4126cc590aa03fc14f0465427e57e12d5b51</hash>
        <iocs>
          <urls>
            <value>
              <url>https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>bugs.launchpad.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>keld@dkuug.dk</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>209.141.37.163</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>31.76.29.161</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.125.189.222</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <btc_wallets>
            <value>
              <btc_wallet>39e4ccb5bf63de842d2cec378dd835e1</btc_wallet>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>0ae38ed87958a5fb1fb385a9ff2d4126cc590aa03fc14f0465427e57e12d5b51.elf</name>
        <report_id>e9f4ca8d-c302-4f87-9089-b304527728c9</report_id>
        <tags>
          <value>elf</value>
          <value>mirai</value>
          <value>dropper</value>
          <value>gcc</value>
          <value>predictive-alin</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>80e089545b787260d9223506ca63596d54e2dc54cf8fce595c848b011cb25b11</id>
    <title>Analysis Report for 80e089545b787260d9223506ca63596d54e2dc54cf8fce595c848b011cb25b11</title>
    <updated>2026-08-20T21:55:44Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877828f2677ae4d366d6ef</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6a8777de099a97c449ef4ce8</flow_id>
        <hash>80e089545b787260d9223506ca63596d54e2dc54cf8fce595c848b011cb25b11</hash>
        <iocs>
          <urls>
            <value>
              <url>https://committeeforgeelong.s.gy/1risQp</url>
              <origin>IMAGE_QR_CODE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>committeeforgeelong.s.gy</url>
              <origin>IMAGE_QR_CODE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>178724134368.3904305.4063350470838208181@PolicSanMarco1.lansystems.it</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>22529c38b1acdeda7e9886f6ae4d4007@policlinico.unict.it</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>92d2ad0b463b9477ba364f4601cfe2ba@policlinico.unict.it</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>ServiceEnquiries.AU@hitachiglobalairpower.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>farmaciasanmarco@policlinico.unict.it</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>207.174.61.1</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>10.167.240.21</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>207.54.83.18</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>77.238.2.40</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>77.238.2.51</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>6b49c39aeb6c2c84faef1ab18e74c3d143b03f157b1d228ced715353d0cf590d</SHA-256>
              <SHA-1>c6475b66f5e3a630cda5ee69762c8d879b373894</SHA-1>
              <MD5>22529c38b1acdeda7e9886f6ae4d4007</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>d8156bae0c4243d3742fc4e9774d8aceabe0410249d720c855f98afc88ff846c</SHA-256>
              <SHA-1>e6a9fc04320a924f46c7c737432bb0389d9dd095</SHA-1>
              <MD5>cfab1ba8c67c7c838db98d666f02a132</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>92d9d0dc85482ee6d4faa66fb752f983710da0d3795aa90221bcbc5841019238</SHA-256>
              <SHA-1>1bfedc622539e09f69603b360a4166e066043b8b</SHA-1>
              <MD5>cdd6c11ec9d164d02d8b29766117998e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>9b9e0cfe-71ff-4941-ff9f-08defed47d66</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>f54277c9-dafe-44aa-85a4-73d5c7c52450</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>phish_alert_sp2_2.eml</name>
        <report_id>9e9f6c83-0f0d-4503-83de-7f4bf7a4254e</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
          <value>html</value>
          <value>obfuscated</value>
          <value>qrcode</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>5ca43a1499cdc8156f54402d28694ba8cba7082501005c18634dcea18cc99c4f</id>
    <title>Analysis Report for 5ca43a1499cdc8156f54402d28694ba8cba7082501005c18634dcea18cc99c4f</title>
    <updated>2026-08-20T21:54:16Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877812f2677ae4d366d6e9</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a8777830dfb99c1ceb09eb0</flow_id>
        <hash>5ca43a1499cdc8156f54402d28694ba8cba7082501005c18634dcea18cc99c4f</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>170ff99bca40e14596be54b227fcd31a3eedf52bbd0ac8ad8c7e22ff79c1379f</SHA-256>
              <SHA-1>c38295092de83dbb4ef6d4be95d45134976f14c1</SHA-1>
              <MD5>664f923e0b49f9c3f6af65d93b2f7a92</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>8b5609421467307f784e3f34240065df5898afe23cdd52fc9be998797d5e1c2b</SHA-256>
              <SHA-1>381676c2fdca7ace207f5dc70e8710ba8ae81286</SHA-1>
              <MD5>3ef0755fe65dfe605b3b6cc64ade808d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>a12867a3cdafebabe335248afef0a4dace6b45ab87063d1a65a4e5861d4a8453</SHA-256>
              <SHA-1>dd7999c637d762174e4b750e0fed9d9c7a3e29a4</SHA-1>
              <MD5>0eaf34fa4d6de16e8f24fbb1b293794f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>a6cb612e7582576dbd7b9675e31a0c69fe36fc49d460d47f7edf09ec068a7c18</SHA-256>
              <SHA-1>beed3636d7177592e20e3d9c9734950f7c3e1578</SHA-1>
              <MD5>2cae66da22dd583737505a4cb7d5ff3a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>ab465f3152d9bbbce52728bd740675960175ddf007345e9289289dcfec1ae5c1</SHA-256>
              <SHA-1>0c4772279ec12134cad93f88770ff9338a93e92f</SHA-1>
              <MD5>7101c8754877e87bffe1e16b7e7ef1c9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>b933a7a8d274bc0ee698d2edc033c2252b5c94275b7535fe05f924e798b090dd</SHA-256>
              <SHA-1>cc05d987580c570a3b140a029f5c78da7c850c82</SHA-1>
              <MD5>d7f2fa6aadb8053f9f1126c9ae5f629b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>c6f509e285e95432f068ea003681875a6bce9751fd5a8d08dedafc72fb694210</SHA-256>
              <SHA-1>bad250dc846ee3096ff943752dbcd4c2e7f13cc7</SHA-1>
              <MD5>e7197d0f308128f7ff1fd4e04f64f2e2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>d415eb004f8b0d3dad3facd594bf9abd1b945e5a378ca17f8c2502dfff3f7829</SHA-256>
              <SHA-1>356849f212717120e1e4affd05f6df8e038f9b5f</SHA-1>
              <MD5>6ce7989669b75c7abb32f51f2bfb3258</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>d8914f93bd70a0a1ac5f8f8b349bd2c492a6e814f8b6f4704776cc3d94579b63</SHA-256>
              <SHA-1>6d2808a338d9db3b8b180e19a58bcae6f8d75176</SHA-1>
              <MD5>40c1c5829abde33204839923cb922d40</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>e206fea85dec3a9a45bf0b6df7fccc2621ba0687fabed29a197f3c1f29794c88</SHA-256>
              <SHA-1>4996c6b06e04e083cc593093fd7e079b10013b6b</SHA-1>
              <MD5>a937fd5177f2ebde06a8adaf4b15193e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>e94adefb4655d9009db8b9093a454a8371a221c387d2f081895c26628e5c9e48</SHA-256>
              <SHA-1>f55c999ed0a290fb66e6e00a05f73f728b7d5807</SHA-1>
              <MD5>5cd5311ec250f13060206b8b910dce08</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>ea845f976e3897fe643a97c02f686f174db45fa78686bb252381afa8db25ab1f</SHA-256>
              <SHA-1>b2d86231b8c5300a341d7413cc4ae68084e0287b</SHA-1>
              <MD5>5407d4d4999873d2f417a59fb79f3b7c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>ed3857d134df065d2d510a4ed207d11151e589c3f01dcb50c7b6788cb2b79ec0</SHA-256>
              <SHA-1>bffd8f94b3bb78bc68790f309d31d7ba255ca19f</SHA-1>
              <MD5>48dfefbf3276016b84c1827f2b6e2c88</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>f61c012dafb46d3af09eacbcf1d185e1af04c3e6a63be0c860e9063270222d9b</SHA-256>
              <SHA-1>f9b675722c3fa9024deae2526ffb2bbe85e4eb07</SHA-1>
              <MD5>ceec9198f4d85aa7151d2360d83089fa</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
          </files>
        </iocs>
        <name>u4-l.exe</name>
        <report_id>eb2210a1-9c86-4a13-aff1-d1e7bae0b14e</report_id>
        <tags>
          <value>peexe</value>
          <value>adaptive-context</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>packed</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>anti-debug</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>85df2289b093eef4689054e6b17c4ad89a307fa60264a1da6c2d0b35c2017e18</id>
    <title>Analysis Report for 85df2289b093eef4689054e6b17c4ad89a307fa60264a1da6c2d0b35c2017e18</title>
    <updated>2026-08-20T21:53:34Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8777f8f2677ae4d366d6e2</_id>
        <file_type>text/html</file_type>
        <flow_id>6a87775d099a97c449ef4c83</flow_id>
        <hash>85df2289b093eef4689054e6b17c4ad89a307fa60264a1da6c2d0b35c2017e18</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.rivestream.app/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <btc_wallets>
            <value>
              <btc_wallet>x433c:$btc: 18H14V15H16V13H14V11H16V9H14V7H1</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>hxxps://www.rivestream.app/</name>
        <report_id>b3b9407b-6cf4-4c73-ad00-c7347dd3c6cc</report_id>
        <tags>
          <value>html</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>38f6a1dd1e738e142160322638dae7b88dabcc30eea3f15c58eb08c5341f9b29</id>
    <title>Analysis Report for 38f6a1dd1e738e142160322638dae7b88dabcc30eea3f15c58eb08c5341f9b29</title>
    <updated>2026-08-20T21:52:43Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877792f2677ae4d366d6cf</_id>
        <file_type>application/x-msdownload; format=pe64</file_type>
        <flow_id>6a8777280dfb99c1ceb09dbb</flow_id>
        <hash>38f6a1dd1e738e142160322638dae7b88dabcc30eea3f15c58eb08c5341f9b29</hash>
        <iocs>
          <urls>
            <value>
              <url>http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.thawte.com/ThawteTimestampingCA.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/sha2-assured-cs-g1.crl05</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/sha2-assured-cs-g1.crl0K</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://ts-aia.ws.symantec.com/tss-ca-g2.cer0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.digicert.com/CPS0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cacerts.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl.thawte.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crl3.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl4.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>ts-aia.ws.symantec.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>ts-crl.ws.symantec.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>23.11.40.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>45.60.131.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>162.159.142.9</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>7efb9168ebbc84c158f194a065fd5d19e6a2ddd3abdb77cc84126a39c8892981</SHA-256>
              <SHA-1>aa62ad10f9a7ead21859ee0556f6797a2322d68e</SHA-1>
              <MD5>a53fa78869907961b8859044f694eef5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>c2b63471dcb8668b842bf3513bda1f5d555d4bbab2da87d6211083327334000d</SHA-256>
              <SHA-1>1afd98c066d2587818f272e633e1b9352e461360</SHA-1>
              <MD5>6b62fb962e723e26c12c28e51a68d3dd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c50a803a0ddfdf77a1bb3a1c1bb6d153393817321a10d71fce8b9139a0b744d7</SHA-256>
              <SHA-1>a3555c3a718f7f02cbec9028025a947537c790c2</SHA-1>
              <MD5>78365d272f7578265c5885ffb251d436</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e</SHA-256>
              <SHA-1>80c9820ff2efe8aa3d361df7011ae6eee35ec4f0</SHA-1>
              <MD5>4842e206e4cfff2954901467ad54169e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/octet-stream</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <registry>
            <value>
              <registry>Software\Valve\Steam</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Valve\Steam\ActiveProcess</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>steam_api64_o.dll</name>
        <report_id>3199b28b-210c-47f9-97be-df94a7ae663b</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>data</value>
          <value>expired-cert</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>anti-debug</value>
          <value>anti-vm</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>5f5c70b32c24b91dbe039b17dd6667bacb5f90cf2911392347170dc33d3623b8</id>
    <title>Analysis Report for 5f5c70b32c24b91dbe039b17dd6667bacb5f90cf2911392347170dc33d3623b8</title>
    <updated>2026-08-20T21:52:22Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877787f2677ae4d366d6cc</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a8777145a70bef4cd151e5a</flow_id>
        <hash>5f5c70b32c24b91dbe039b17dd6667bacb5f90cf2911392347170dc33d3623b8</hash>
        <iocs>
          <emails>
            <value>
              <email>support@genarts.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <files>
            <value>
              <SHA-256>3971acae7afff86d90226ce32e44106c812abecaeba0c2bf10117977bacb8bd4</SHA-256>
              <SHA-1>610367ab94c2bb6107168b4376316b64489c3d88</SHA-1>
              <MD5>b5e574b18d86ecc3d1cc7a4f7900971a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>b75c505cc8398d2488cc1821a8685e294531ca33fc340b8b2abdebee86f1ccb4</SHA-256>
              <SHA-1>033ba247fba63e14c8871d6817dc8b1887c9387a</SHA-1>
              <MD5>bf0f166d6f04873d9bf1399cbc502cfa</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>e4b8b3db2d0dce95f7ae80a72605da73de05dd3e4cc8113a3cbbf7bfe6382dde</SHA-256>
              <SHA-1>2eec3a570ea8bc4804c08ad7bc3a2b31fd748e8b</SHA-1>
              <MD5>b16ad9cd6ce9735efaaacc8f3c25bc01</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>ee3263c2f9077ba3d4053a70a5c090df5e4d409868a6f311c3539d867fd94c9b</SHA-256>
              <SHA-1>5f72cdc26e03b7f7eda06c239e1dff87c6675ec6</SHA-1>
              <MD5>c7ace47fa7823842ec38a43868a7a001</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>f83a1bff4d7de1d6b2c25764430d3b27877b26e9e28d29cdd4cd905bd8dc999a</SHA-256>
              <SHA-1>d188b02e49b5909015929c890ba720f37c3201b9</SHA-1>
              <MD5>ab832d22b4fe62b20c1a896007aaa1f4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>x119d7f6:$btc: 333333333333333333333333333333</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x119d816:$btc: 3333333333333333333333333333</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>Sapphire.ofx</name>
        <report_id>67ec8dde-4a6b-47e1-a8f3-d6cfe5a2f438</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>crypto</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>anti-vm</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>keylogger</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>470d9ffd77c2e67afab9049a0e993d267d67f49a65b5bcb36bcc517c19a3cef1</id>
    <title>Analysis Report for 470d9ffd77c2e67afab9049a0e993d267d67f49a65b5bcb36bcc517c19a3cef1</title>
    <updated>2026-08-20T21:52:04Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877754f2677ae4d366d6b9</_id>
        <file_type>text/plain</file_type>
        <flow_id>6a877700099a97c449ef4c2b</flow_id>
        <hash>470d9ffd77c2e67afab9049a0e993d267d67f49a65b5bcb36bcc517c19a3cef1</hash>
        <iocs/>
        <name>Runtime.txt</name>
        <report_id>c06ed3ee-941f-4b42-a47c-48e4280ec4a0</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>3a577897236d7e48cff7f39beed65fa2bea86f9010cfc53f5ee63e52d910c7ec</id>
    <title>Analysis Report for 3a577897236d7e48cff7f39beed65fa2bea86f9010cfc53f5ee63e52d910c7ec</title>
    <updated>2026-08-20T21:52:04Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87775cf2677ae4d366d6be</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a877700099a97c449ef4c2b</flow_id>
        <hash>3a577897236d7e48cff7f39beed65fa2bea86f9010cfc53f5ee63e52d910c7ec</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>03dc9605f5f803bba1cf370eb96ebb4496e55d11d1a6b6a1378164d75d419e3d</SHA-256>
              <SHA-1>4efa5e18a9fc39189236db7ad7a4b01cd4fbfbad</SHA-1>
              <MD5>735bc09c39392a510744f5a3e06f0ec3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>04fbe2b425ec71b2f63ffc47b4ac33d3e7ee637fce1c80d45519cbdbd1fd5824</SHA-256>
              <SHA-1>13dca97a802227046401c6aa939fa8d05e7a7df8</SHA-1>
              <MD5>ef3ee7d7bce3db471e2e952f228f8d25</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>image/webp</file_type>
            </value>
            <value>
              <SHA-256>0f3e280fdb90208450b1e8246f5bfcbccb825a7707df03871d270b13e9a06f02</SHA-256>
              <SHA-1>ddb57e5976edb40dd605902e789e749fb4c50c82</SHA-1>
              <MD5>6227decb5931c2591498b2fdfcbbed57</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df</SHA-256>
              <SHA-1>4260284ce14278c397aaf6f389c1609b0ab0ce51</SHA-1>
              <MD5>1e4a89b11eae0fcf8bb5fdd5ec3b6f61</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>718c5cf94e44be83e3cab64f1c44a2984cd5a12efba6ed03c6815071d6a6f8da</SHA-256>
              <SHA-1>0bb044f0bcf7b2bb009b886f44f0f60dde0b5fae</SHA-1>
              <MD5>7d37833a4fe97cac1c9d32fa60d31a5a</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>97056b9e67bde0c4d791a68a3f9243339d089ab376c127fcfb6ff2231b293736</SHA-256>
              <SHA-1>69db6a65e9cca037dc23b4d308fc9ceee2dd5828</SHA-1>
              <MD5>241ce3e4168e5d8f6a5970f67be9478b</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c5721e3d8426d792e673a58091294c7404f3906c338242bddd73a23602d5703a</SHA-256>
              <SHA-1>f5c464c2f7c47bdfa0720094134cc568e3149071</SHA-1>
              <MD5>854d876b762133ce0d0015455e3f60a9</MD5>
              <origin>PE_UNPACKING</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
          </files>
        </iocs>
        <name>WM_Spectrasonics.r2rwm</name>
        <report_id>3c7c7ad3-3f03-47c5-88c0-086c2602dff2</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>overlay</value>
          <value>packed</value>
          <value>microsoft_visual_cc</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>614bfaf54ecfd596e09ef8ca917b1eed6f7112769594a7b7a6f24aafdd8792eb</id>
    <title>Analysis Report for 614bfaf54ecfd596e09ef8ca917b1eed6f7112769594a7b7a6f24aafdd8792eb</title>
    <updated>2026-08-20T21:52:04Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877769f2677ae4d366d6c3</_id>
        <file_type>text/plain</file_type>
        <flow_id>6a877700099a97c449ef4c2b</flow_id>
        <hash>614bfaf54ecfd596e09ef8ca917b1eed6f7112769594a7b7a6f24aafdd8792eb</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.spectrasonics.net/authorization</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.spectrasonics.net/authorization</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>spectrasonics.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>spectrasonics.net</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>100.22.102.78</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>d1ee7a266965bb093902a1ac0533284ec760c04f30ccd1bbe6bee71b05e150ec</SHA-256>
              <SHA-1>799c7c338c00ccdfd2de40ba36b53caa02870228</SHA-1>
              <MD5>cb7ed75ac6d981df76edcd61133bbaaa</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>R2R.txt</name>
        <report_id>bffb3603-53b5-42f7-9a35-c11328dbc276</report_id>
        <tags>
          <value>txt</value>
          <value>html</value>
          <value>captcha</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>c425e5aaa2e1c75962cfe874b40acf972c3f0db3485dc548ef0362fce74b2fdc</id>
    <title>Analysis Report for c425e5aaa2e1c75962cfe874b40acf972c3f0db3485dc548ef0362fce74b2fdc</title>
    <updated>2026-08-20T21:52:04Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87777bf2677ae4d366d6c8</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a877700099a97c449ef4c2b</flow_id>
        <hash>c425e5aaa2e1c75962cfe874b40acf972c3f0db3485dc548ef0362fce74b2fdc</hash>
        <iocs>
          <urls>
            <value>
              <url>https://jrsoftware.org/ishelp/index.php?topic=setupcmdline</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://jrsoftware.org/ishelp/index.php?topic=setupcmdline</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>jrsoftware.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>jrsoftware.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>75.119.223.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>f4c7d6a5a836c404fe9bfe7c21acaec805bce303326405a8cd31971697508e11</SHA-256>
              <SHA-1>ca4a292a8d3f1a3a2634b47d5009ad715415dbd6</SHA-1>
              <MD5>9d4fdcf1e564adcd0dbd7fbd8d7a5abd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>d06502bbaea8b3ba96e956813aad7be422b422e53341c789ee1d4af24ca532ff</SHA-256>
              <SHA-1>64438758d4c705d81ca426216473df55ee209bda</SHA-1>
              <MD5>80c32627daabe744099d966459b5ad99</MD5>
              <origin>PE_EMULATION</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>eff3254b5d8f6a458d56d3b2ea98e87efdc92412f848a040f3107929428fb8ad</SHA-256>
              <SHA-1>526b1c75e292aa330052185ed85d1749bbbcb10b</SHA-1>
              <MD5>ead5a7a910889c6417446549a08bdbc7</MD5>
              <origin>PE_EMULATION</origin>
              <file_type>audio/mpeg</file_type>
            </value>
            <value>
              <SHA-256>adb81901042f2654154a003d72e83217aed1403ab25978494cae1df247fec716</SHA-256>
              <SHA-1>be01dc45b5dd45a6ef45a59bd99035b8f5822497</SHA-1>
              <MD5>5decd90cee87bb0ceab8762287b90be0</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <registry>
            <value>
              <registry>SOFTWARE\Microsoft\Windows NT\CurrentVersion</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Delphi\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\CodeGear\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\Embarcadero\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\Microsoft\Windows NT\CurrentVersion</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Delphi\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\CodeGear\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Embarcadero\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>Setup Omnisphere v3.0.2c.exe</name>
        <report_id>6e8a2558-c818-45bc-ab81-50131a897993</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>evasive</value>
          <value>large-file</value>
          <value>masquerade</value>
          <value>anti-debug</value>
          <value>adaptive-context</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>installer</value>
          <value>packed</value>
          <value>reconnaissance</value>
          <value>inno</value>
          <value>embarcadero_delphi</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>7cd618edf6ca12c818a92330d675d37e05b0be191aff19ec798eda1faeeb0122</id>
    <title>Analysis Report for 7cd618edf6ca12c818a92330d675d37e05b0be191aff19ec798eda1faeeb0122</title>
    <updated>2026-08-20T21:51:43Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87776949c2438a47b72b1e</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8775931d88974f46c408e0</flow_id>
        <hash>7cd618edf6ca12c818a92330d675d37e05b0be191aff19ec798eda1faeeb0122</hash>
        <iocs>
          <urls>
            <value>
              <url>https://accounts.google.com/AccountChooser?hl%5Cu003den-US</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/Logout?hl%5Cu003den-US</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?ltmpl%5Cu003dmeet%5Cu0026osid%5Cu003d1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/TOS</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/TOS?privacy=true</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://addons-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://addons.gsuite.google.com/client</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admin.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://appsgrowthpromo-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://assistant.google.com/tasks</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://calendar.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://client-channel.google.com/client-channel/client</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://client-side-encryption.google.com/meet/init</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://client-side-encryption.google.com/oidc/meet/callback</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://clients4.google.com/invalidation/lcs/client</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://connect.corp.google.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://contacts.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/picker</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://jamboard.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://meet.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://meet.google.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://meet.google.com/meb-jyvf-qsy</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://meet.google.com/tools/quality</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://meet.google.comv1_meetings</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://myaccount.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://myphonenumbers-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://play.google.com/log?format%5Cu003djson%5Cu0026hasfast%5Cu003dtrue</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://slides-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://slides-pa.clients6.google.comAIzaSyCG_6Rm6c7ucLr2NwAq33-vluCp2VfSkf0v1internal</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://takeout.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://videoconf.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://workspace.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://workspaceui-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.google.com/js/bg/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://meet.google.com/meb-jyvf-qsy?hs=224</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>accounts.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>addons-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>addons.gsuite.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>admin.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>appsgrowthpromo-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>assistant.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>calendar.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>client-channel.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>client-side-encryption.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>clients4.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>connect.corp.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>contacts.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>docs.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>jamboard.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>meet.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>meet.google.comv1_meetings</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>myaccount.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>myphonenumbers-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>play.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>slides-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>slides-pa.clients6.google.comAIzaSyCG_6Rm6c7ucLr2NwAq33-vluCp2VfSkf0v1internal</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>takeout.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>videoconf.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>workspace.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>workspaceui-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.20.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.84</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.129</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>3644e40f8e5d3242d3ed34544ecd8afdceae408519c17d4a4b037bac8f1771d0</SHA-256>
              <SHA-1>e125f2339d9e5f7f15750b15688f6361dda001f2</SHA-1>
              <MD5>e985ef1e2b277d5f20877ad92208001a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>1e5d1a70f27428980a90138d4cbe265cbb0387964cb9ca4afb7e5347f73fc66e</SHA-256>
              <SHA-1>37e3005a14759bdc8cea88cfb73f2e701b02e040</SHA-1>
              <MD5>4855c0d8969fd335310e40fd1ed0d02f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>fca0d119cd9d99e14db753bc29803ecfb14b61cc44a8ed7117014a1a721f4289</SHA-256>
              <SHA-1>bd1f191ead52ee1bce9a968a05d66c9fe9cf8c14</SHA-1>
              <MD5>b665c7608ad78c8bd7741d60653d12af</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>2235cd8cc6d433a4f064be32baa2c062c1bb69e05ef2d367801b81e6eacc8537</SHA-256>
              <SHA-1>98f670d57a468755e48349ee05572a787207dae5</SHA-1>
              <MD5>6b0a079a0c4e3c1f96064b90157e3725</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>e6a6897d30adee59c987b68828b10eb2bbb09ce1b19e4dfd6ec4a31eedba8224</SHA-256>
              <SHA-1>c4dfec299cd35f547f2ef8fd9622b843a2d75f09</SHA-1>
              <MD5>82919b425fe45257a957c8e3c3f1af96</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>51a95be02862196a19778bcab25c8bdb6f0c9c6c87c43301c9a80166a05a4a98</SHA-256>
              <SHA-1>0cb85ca8e96c53615894a621b3363815ef14f9e7</SHA-1>
              <MD5>b3cd67e3d7b130269e1ce1c670c11883</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>48fb2432ba46327b0dfca9daff1a90c486ec102e674020e2cdb152350db955bd</SHA-256>
              <SHA-1>ec22d89e7a8b26022ce4afd189cdffb9b96464a2</SHA-1>
              <MD5>e73c6d8c7cc5ac8121ac9144e37836e6</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>x129cb4:$btc: 1sTptfoBNJsAAADojKspdi823jjmiKMmT</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x18b728:$btc: 1v4KAP6BqzCc1MbBXRqCAub2n</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x18e568:$btc: 1c5WDhLHy5F1JL4m3N3ivJjTv12</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>hxxps://meet.google.com/meb-jyvf-qsy?hs=224</name>
        <report_id>f41efbbc-9a00-4cd3-ba02-bb31d0cf900e</report_id>
        <tags>
          <value>html</value>
          <value>base64</value>
          <value>obfuscated</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>062d5d106ba1ee079907c4fbe0d21d29b29cc8f0528c0a9471e8ac8af66ca5b7</id>
    <title>Analysis Report for 062d5d106ba1ee079907c4fbe0d21d29b29cc8f0528c0a9471e8ac8af66ca5b7</title>
    <updated>2026-08-20T21:51:39Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87772ff2677ae4d366d6b0</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8776e9009ae7a1a8d2e45e</flow_id>
        <hash>062d5d106ba1ee079907c4fbe0d21d29b29cc8f0528c0a9471e8ac8af66ca5b7</hash>
        <iocs>
          <urls>
            <value>
              <url>phoenixpoolcontractor.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-520/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing?utm_source=errorcode_520&amp;utm_campaign=phoenixpoolcontractor.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://phoenixpoolcontractor.com/curl/899e38e42680fe273eeda8f62382dc988907196817db5bc06e374df6c8a6dfa9</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>developers.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.16.124.96</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.16.3.189</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>831784d896048212913d274faeb97dfeebe55096163fe8039d7b52def7848d69</SHA-256>
              <SHA-1>ba0103ea79410d6bae7b0f4e9885ab34f44aabe1</SHA-1>
              <MD5>2e06af9cc9527c42a920c4b7bc62cb6d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>2868721739cbcf566f11ae69d47b939f8665f40a9f4ba41dc17df8f7120a1a54</SHA-256>
              <SHA-1>cc2f3c058ed54b2b5619b8f91ec6790bfe097739</SHA-1>
              <MD5>5aecb575045355d768c30760a0f89bc3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>b4ca3868e8c8ca5b645f3dd5d8fea2ef09ccdf63564d55bbaccd1f5430ac6865</SHA-256>
              <SHA-1>3fa24a787f2d9655ac0ce80b3137dcda4ffbc6a3</SHA-1>
              <MD5>b300f90890163b12500bebe292bac5ea</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>08a149dc7bc73146b393b7bf89576dd5724842048a2173fdbd4e51a98bd18d5e</SHA-256>
              <SHA-1>5b381e3d73c6bc516f0f061fecf137b6f427390c</SHA-1>
              <MD5>dd8378496399c53b3d40d683e153fcdd</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxp://phoenixpoolcontractor.com/curl/899e38e42680fe273eeda8f62382dc988907196817db5bc06e374df6c8a6dfa9</name>
        <report_id>5074ccde-0bc8-4744-93da-525d18ef8fd8</report_id>
        <tags>
          <value>html</value>
          <value>captcha</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f54c4a05a88da2bad71de707683b791ed4c203d1dca9b3d5d942efe601f38806</id>
    <title>Analysis Report for f54c4a05a88da2bad71de707683b791ed4c203d1dca9b3d5d942efe601f38806</title>
    <updated>2026-08-20T21:51:15Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8776ebf2677ae4d366d6a4</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a8776d20dfb99c1ceb09ce0</flow_id>
        <hash>f54c4a05a88da2bad71de707683b791ed4c203d1dca9b3d5d942efe601f38806</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schemas.microsoft.com/SMI/2</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/SMI/2</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>jrsoftware.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>jrsoftware.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>75.119.223.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>1.0.0.0</ip>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>100de61a733b6870f064cff8ef24890cc3b27c9b01c0d7170ba449afa4619e22</SHA-256>
              <SHA-1>152d91be38d42a149cc884fdfde036ef5b33256d</SHA-1>
              <MD5>5c434dd9d91ae5709399ebfb46361d4f</MD5>
              <origin>PE_EMULATION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>d5482ae2640dcd4c4302fd93ca9e21cff5ca79375da7c2509693a29bb5122b42</SHA-256>
              <SHA-1>909e928c9da8b8a84e80a6a9faeb8e1a8438b29a</SHA-1>
              <MD5>dd0fcbf32e3121d8cadf5fbad04f9efc</MD5>
              <origin>PE_EMULATION</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>adb81901042f2654154a003d72e83217aed1403ab25978494cae1df247fec716</SHA-256>
              <SHA-1>be01dc45b5dd45a6ef45a59bd99035b8f5822497</SHA-1>
              <MD5>5decd90cee87bb0ceab8762287b90be0</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>Software\Borland\Delphi\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Delphi\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>setup.exe</name>
        <report_id>b6a05189-3897-4ba6-871e-fb6a1475d471</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>packed</value>
          <value>evasive</value>
          <value>fingerprint</value>
          <value>installer</value>
          <value>reconnaissance</value>
          <value>inno</value>
          <value>embarcadero_delphi</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>790a08c48309311973aa0725575afc79b8a7faa255ce272c4353bbb143bbaf93</id>
    <title>Analysis Report for 790a08c48309311973aa0725575afc79b8a7faa255ce272c4353bbb143bbaf93</title>
    <updated>2026-08-20T21:50:26Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8776cef2677ae4d366d69d</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8776a1009ae7a1a8d2e366</flow_id>
        <hash>790a08c48309311973aa0725575afc79b8a7faa255ce272c4353bbb143bbaf93</hash>
        <iocs>
          <urls>
            <value>
              <url>https://ziperto.vip/super-mario-odyssey/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/super-mario-odyssey/&amp;format=xml</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://1fichier.com/?6ar3amvsjjwhs1gmftz7&amp;af=1951572</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://1fichier.com/?e5970bvomzihxjq0nc9s&amp;af=1951572</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://1fichier.com/?jhk5waq65zjl2k65a29e&amp;af=1951572</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://buzzheavier.com/nw69p80yc4ut</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://chromewebstore.google.com/detail/adblock-%E2%80%94-block-ads-acros/gighmmpiobklfepjocnamgkkbiglidom</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://frdl.my/k36muokkojk0</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://frdl.my/qhgi9876lotv/SUPER_MARIO_ODYSSEY_%5B0100000000010000%5D+%5Bv1.3.0%5D%5BUS%5D(SuperXCI).xci.rar.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://frdl.pw/idzpwep5wi9w</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/js-cookie/js-cookie</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://gmpg.org/xfn/11</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://megaup.net/2zQf0/Super_Mario_Odyssey_(NSP)(Base_Game).part1.rar</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://megaup.net/2zQfp/Super_Mario_Odyssey_(NSP)(Base_Game).part2.rar</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://s.w.org/images/core/emoji/17.0.2/72x72/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://s.w.org/images/core/emoji/17.0.2/svg/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://secure.gravatar.com/avatar/c5b2b64eaf3dcccb4364a9ca3c36f4162a266bf21bddc27ba780d538562c3508?s=96&amp;amp;d=mm&amp;amp;r=g</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://send.now/jkp3ua9ksgyx</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=GT-MKB3B2B6</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.nintendo.com/us/store/products/super-mario-odyssey-switch/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/?p=270</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/author/nadirali3467979gmail-com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/category/nintendo/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/category/switch-dlcs/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/category/switch-games/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/category/switch-nsps/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/category/switch-roms/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/category/switch-xcis/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/comments/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/elden-ring-tarnished-edition/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/elden-ring-tarnished-edition/#respond</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/super-mario-odyssey/#respond</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/super-mario-odyssey/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-comments-post.php</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-content/plugins/hostinger-reach/frontend/dist/blocks/subscription-view.js?ver=1786086692</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-content/plugins/hostinger-reach/frontend/dist/blocks/subscription.css?ver=1786086692</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-content/themes/kontrast/fonts/all.min.css?ver=7.0.4</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-content/themes/kontrast/js/jquery.fitvids.js?ver=7.0.4</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-content/themes/kontrast/js/jquery.flexslider.min.js?ver=7.0.4</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-content/themes/kontrast/js/nav.js?ver=1777004134</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-content/themes/kontrast/js/scripts.js?ver=7.0.4</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-content/themes/kontrast/responsive.css?ver=7.0.4</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-content/themes/kontrast/style.css?ver=7.0.4</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-content/uploads/2026/04/cropped-favicon-180x180.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-content/uploads/2026/04/cropped-favicon-192x192.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-content/uploads/2026/04/cropped-favicon-32x32.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-includes/js/comment-reply.min.js?ver=7.0.4</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://ziperto.vip/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://ziperto.vip/wp-includes/js/jquery/jquery.min.js?ver=3.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://ziperto.vip/wp-json/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-json/oembed/1.0/embed</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fziperto.vip%2Fsuper-mario-odyssey%2F</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fziperto.vip%2Fsuper-mario-odyssey%2F&amp;format=xml</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/wp-json/wp/v2/posts/270</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/xmlrpc.php</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/xmlrpc.php?rsd</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/super-mario-odyssey/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=DM+Sans:wght@400;600&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K4.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/hcdn-cgi/jschallenge</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ziperto.vip/super-mario-odyssey/</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ziperto.vip</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>1fichier.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>buzzheavier.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>chromewebstore.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>frdl.my</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>frdl.pw</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>gmpg.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>megaup.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>s.w.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>secure.gravatar.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>send.now</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.nintendo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ziperto.vip</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.20.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>92.113.16.43</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.239.47.13</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>91.208.162.127</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.239.194.103</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.26.10.65</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>5.39.224.140</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.121.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.2.146</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>146.75.121.55</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>66.155.40.24</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>92.113.23.93</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.0.73.2</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.0.77.48</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>7f1f1c3e964bfd63fec353144ca822f44bc55328541f848fa23f4dc61222d662</SHA-256>
              <SHA-1>aba0d3fb4654f2f9d41a6c9c40bb3effb304483c</SHA-1>
              <MD5>5911f5b378885e3fb309150d1f943de4</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/jpeg</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>220bcb1ca2a00dad8195df3f900f82cab60fa423364e9d9aff31559947bf15ce</SHA-256>
              <SHA-1>8d52cf5d7815d3679d1cd8f326471edfe9fd9f34</SHA-1>
              <MD5>4ddcdb6a2d207dd0277856f0549bcf60</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>6b32e8aad1ca077eef96b4a76f0484d7594681ce3832a2b547fbf6bf8966aea6</SHA-256>
              <SHA-1>ae127d7831abfb67a5234fb33019867ba5b0e673</SHA-1>
              <MD5>a168bf74ae14bd3b68a44672b09e454d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>140189c80a195a6907aa8301ef04b1b93dda61126a4b4fd9e680b3eec4e88c94</SHA-256>
              <SHA-1>fb234fb964efe109e5ac843535786b8bacf94d55</SHA-1>
              <MD5>6781d875d392def8278786c6d65229ee</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>0d037d0ac35111285f00289e1a929e539c278d4d47847b8e8059793d4ba0908a</SHA-256>
              <SHA-1>927331f261aa900ba4de828e75d2f6c3b786bcb2</SHA-1>
              <MD5>f90520ce8a94803be7864ed7ee493c24</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>d2fbdd74fdc727811777f12bb8343744b71b4301995f1098fe70fb5b8404f252</SHA-256>
              <SHA-1>d92d022c9b8ff096637f57992413fbf41a5c5174</SHA-1>
              <MD5>7741bb3d7b77441db068486a0cc1fa02</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>087760e0e0b8d84ca219850b90f47e2b62dd923056dd64fade24856b2695cd46</SHA-256>
              <SHA-1>468b8b451d78c6bcf560813341dbf12ca9d77516</SHA-1>
              <MD5>3053446b4df8d559cd474f01ab6d413c</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>e0d5d357cd5f7b3c048ae756409aebf5900cf1e5ca78fff6e0bfe25dd41e3b3a</SHA-256>
              <SHA-1>86a1b0bb65b8826a09aa8044c9b4044527664bce</SHA-1>
              <MD5>28af3b1ca136beae58699429056f48ba</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://ziperto.vip/super-mario-odyssey/</name>
        <report_id>0bd43d2d-1b8d-4cad-a28c-169747ae72a2</report_id>
        <tags>
          <value>html</value>
          <value>jpg</value>
          <value>base64</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>5c7b26137b6faf8d2e86a65aeaf24e71de4be3f278aaf8f69292262c4a6e6322</id>
    <title>Analysis Report for 5c7b26137b6faf8d2e86a65aeaf24e71de4be3f278aaf8f69292262c4a6e6322</title>
    <updated>2026-08-20T21:49:41Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877682f2677ae4d366d68f</_id>
        <file_type>application/vnd.ms-outlook</file_type>
        <flow_id>6a877672009ae7a1a8d2e2b4</flow_id>
        <hash>5c7b26137b6faf8d2e86a65aeaf24e71de4be3f278aaf8f69292262c4a6e6322</hash>
        <iocs>
          <urls>
            <value>
              <url>https://nam10.safelinks.protection.outlook.com/</url>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <url>https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity.microsoft.com%2FuserSubmissionsReportMessage&amp;data=05%7C02%7CHelpDesk%40antamina.com%7C856d42a4e5444b3d4cdb08defefae539%7C81d621751b4e4e3eab079155ea9063ab%7C1%7C0%7C639228551169316168%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=20a96wWTY2jHaZwnR6Umn67Mn2o3KFOcOy7lPFwEmDU%3D&amp;reserved=0</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>antamina.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://security.microsoft.com/userSubmissionsReportMessage&amp;data=05</url>
              <origin>EMAIL_BODY</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>antamina.com</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>https://security.microsoft.com/userSubmissionsReportMessage&amp;data=05</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>https://nam10.safelinks.protection.outlook.com/</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity.microsoft.com%2FuserSubmissionsReportMessage&amp;data=05%7C02%7CHelpDesk%40antamina.com%7C856d42a4e5444b3d4cdb08defefae539%7C81d621751b4e4e3eab079155ea9063ab%7C1%7C0%7C639228551169316168%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=20a96wWTY2jHaZwnR6Umn67Mn2o3KFOcOy7lPFwEmDU%3D&amp;reserved=0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>antamina.com</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>https://nam10.safelinks.protection.outlook.com/</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity.microsoft.com%2FuserSubmissionsReportMessage&amp;data=05%7C02%7CHelpDesk%40antamina.com%7C856d42a4e5444b3d4cdb08defefae539%7C81d621751b4e4e3eab079155ea9063ab%7C1%7C0%7C639228551169316168%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=20a96wWTY2jHaZwnR6Umn67Mn2o3KFOcOy7lPFwEmDU%3D&amp;reserved=0</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://security.microsoft.com/userSubmissionsReportMessage&amp;data=05</url>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <url>https://security.microsoft.com/userSubmi</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schema.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://nam10.safelinks.protection.outlook.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity.microsoft.com%2FuserSubmi</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>nam10.safelinks.protection.outlook.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>nam10.safelinks.protection.outlook.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schema.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>nam10.safelinks.protection.outlook.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>nam10.safelinks.protection.outlook.com</url>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>DS4PPF1F77AB10FFD6D899F57531AFF960DDFA42@DS4PPF1F77AB10F.namprd10.prod.outlook.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>bjurado@antamina.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>cguerrero@antamina.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>colivera@antamina.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>gtorrejon@antamina.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>imarmolejo@antamina.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>mdiazm@antamina.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>ogarciad@antamina.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>osaturno@antamina.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>rantara@antamina.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>rcanahualpa@antamina.com</email>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <email>0D0DCB38893EA94B9F06C15E84E718E1@DM8PR10MB5478.namprd10.prod.outlook.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>42a9-13c0-08defecdd398.NotJunk.639228550646738403@microsoft.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>DS4PPF1F77AB10FFD6D899F57531AFF960DDFA42@DS4PPF1F77AB10F.namprd10.prod.outlook.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>HelpDesk@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>JMR.838162e5-c388-42a9-13c0-08defecdd398.NotJunk.639228550646738403@microsoft.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>alopezv@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>bjurado@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>cguerrero@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>ciberseguridadmonitoreo@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>colivera@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>dpomalaza@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>gtorrejon@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>image001.png@01DD308C.C573D3C0</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>imarmolejo@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>jedquen@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>jrecuay@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>manpower.ecalderon@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>mdiazm@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>mtafur@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>ogarciad@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>osaturno@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>phishingreport@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>rantara@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>rcanahualpa@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>rchacpa@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>rescajadillo@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>vpajuelo@antamina.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>DS4PPF1F77AB10FFD6D899F57531AFF960DDFA42@DS4PPF1F77AB10F.namprd10.prod.outlook.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>bjurado@antamina.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>cguerrero@antamina.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>colivera@antamina.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>gtorrejon@antamina.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>imarmolejo@antamina.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>mdiazm@antamina.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>ogarciad@antamina.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>osaturno@antamina.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>rantara@antamina.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>rcanahualpa@antamina.com</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>DS4PPF1F77AB10FFD6D899F57531AFF960DDFA42@DS4PPF1F77AB10F.namprd10.prod.outlook.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>bjurado@antamina.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>cguerrero@antamina.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>colivera@antamina.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>gtorrejon@antamina.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>imarmolejo@antamina.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>mdiazm@antamina.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>ogarciad@antamina.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>osaturno@antamina.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>rantara@antamina.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <email>rcanahualpa@antamina.com</email>
              <origin>EMAIL_BODY</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>255.255.255.255</ip>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>255.255.255.255</ip>
              <origin>EMAIL_BODY</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>163.116.229.139</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>181.66.167.61</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>255.255.255.255</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>255.255.255.255</ip>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>52.102.113.69</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>874fa7cf1c4591f178de211988ffc49dd3f31f2ac331ca986bef1897d105b93f</SHA-256>
              <SHA-1>b8e5da7a46805d22ce63485c7090776ae0d25d8b</SHA-1>
              <MD5>a38c2e90c011a2aa75d90fc6061aaf5a</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>f69ec9c7d598b2859ac983ef6adb3a865e7037b097cbc06d8f32582679309483</SHA-256>
              <SHA-1>15b9c0c456b6a113d34bb53c0df25423f6db277c</SHA-1>
              <MD5>504ae2e068b4f2f58f27804a5db9b9ba</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>86a7aeb51ff55314576f9198afded5b94ae7a6f0d417912263834f4b3b49e5a0</SHA-256>
              <SHA-1>cd1547f97ec195b8896c34c344284cb438ddeadc</SHA-1>
              <MD5>511a34d30eaf4b202bc0357d9549318f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>5f6625eae63cee608ec3279bb83f147d7b024b8b8b02f2ee6b4ec150fa07b82e</SHA-256>
              <SHA-1>0b67be584e86235903159bd4a48b98ed19f06539</SHA-1>
              <MD5>265bc7a2f3ba6a4d2685ab4831926995</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>7c41b898c5da0cfa4aa049b65ef50248bce9a72d24bef4c723786431921b75aa</SHA-256>
              <SHA-1>10588307553e766ab3c7d328d948dc6754893cef</SHA-1>
              <MD5>825644f747baab2c00e420dbbc39e4b3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>0163d8e1-41c3-4213-b931-06bd0cd98077</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>036d62aa-415b-4bda-be95-f9fd9ec25904</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>0ef9d27b-9171-fe4e-b169-a2559ce6fbd8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>1140cd79-ad87-4043-a562-c768acacc6ba</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>1dd00963-4b87-436a-981d-9bc05dd0ec80</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>3b3d817a-9190-465b-af2d-9e856f894059</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>483023e9-d3fd-4c50-8b50-f7a3f8078c33</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>6127b09f-1159-4af9-b5a2-f7a3573a6591</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>6601c537-b543-4a40-a5dc-4755365bde1e</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>81d62175-1b4e-4e3e-ab07-9155ea9063ab</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>838162e5-c388-42a9-13c0-08defecdd398</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>839aecf8-c67b-4270-8aaf-378127b23b7f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>856d42a4-e544-4b3d-4cdb-08defefae539</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8b6b6bfa-d1c7-4f6f-ba3f-a2bc598b6687</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>911b7815-6883-4022-a882-9cbe9462f114</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>9f828fcf-4f2d-48c5-a2db-a72135c5ac46</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>adbbb20e-b175-46e7-8ba2-cf3f3179d0ed</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>c0cedde9-e37e-45d8-9861-b9eb586e6a71</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>c2242c5a-b3d0-4a94-ba34-009ebded79e8</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>cf73725b-f43c-4a0c-9c04-c78a742b1288</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>d9f25808-4014-4491-b88b-08defefae311</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>db316d87-4581-4b30-8993-498f6356c2e5</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>f7783aa9-7247-48a4-8f82-e58e86cdb112</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>81d62175-1b4e-4e3e-ab07-9155ea9063ab</uuid>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <uuid>838162e5-c388-42a9-13c0-08defecdd398</uuid>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <uuid>81d62175-1b4e-4e3e-ab07-9155ea9063ab</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>838162e5-c388-42a9-13c0-08defecdd398</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>81d62175-1b4e-4e3e-ab07-9155ea9063ab</uuid>
              <origin>EMAIL_BODY</origin>
            </value>
            <value>
              <uuid>838162e5-c388-42a9-13c0-08defecdd398</uuid>
              <origin>EMAIL_BODY</origin>
            </value>
          </uuids>
        </iocs>
        <name>Not junk838162e5-c388-42a9-13c0-08defecdd398rantara@antamina.com(REGISTRO_MANTENIMIENTO_BOMBAS_MOLIENDA_Rev2.7.xlsx) 08202026 203744.msg</name>
        <report_id>237c8a44-7c70-4e99-aaeb-ea35b6e3db67</report_id>
        <tags>
          <value>msg</value>
          <value>ole</value>
          <value>html</value>
          <value>txt</value>
          <value>obfuscated</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>fe90b0f1eb82ff6918fa8bfdf9b3b9b6150ca27fe910f8899241d07a2e57a309</id>
    <title>Analysis Report for fe90b0f1eb82ff6918fa8bfdf9b3b9b6150ca27fe910f8899241d07a2e57a309</title>
    <updated>2026-08-20T21:46:16Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87762af2677ae4d366d67b</_id>
        <file_type>application/x-msdownload; format=pe64</file_type>
        <flow_id>6a8775a6009ae7a1a8d2df32</flow_id>
        <hash>fe90b0f1eb82ff6918fa8bfdf9b3b9b6150ca27fe910f8899241d07a2e57a309</hash>
        <iocs/>
        <name>fe90b0f1eb82ff6918fa8bfdf9b3b9b6150ca27fe910f8899241d07a2e57a309.exe</name>
        <report_id>b627e229-5e37-4c16-ae7f-f8ac640b8e07</report_id>
        <tags>
          <value>peexe</value>
          <value>packed</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>eb0236639e35682020bc94b1a466cd07889bb0ebbccc4ec4876b68b16de84bb2</id>
    <title>Analysis Report for eb0236639e35682020bc94b1a466cd07889bb0ebbccc4ec4876b68b16de84bb2</title>
    <updated>2026-08-20T21:46:03Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87765749c2438a47b72ae9</_id>
        <file_type>text/html</file_type>
        <flow_id>6a87759267502b6ca997ae1c</flow_id>
        <hash>eb0236639e35682020bc94b1a466cd07889bb0ebbccc4ec4876b68b16de84bb2</hash>
        <iocs>
          <urls>
            <value>
              <url>https://tel.meet/meb-jyvf-qsy?pin=9873753615312&amp;hs=7</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://accounts.google.com/AccountChooser?hl%5Cu003den-US</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/Logout?hl%5Cu003den-US</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?ltmpl%5Cu003dmeet%5Cu0026osid%5Cu003d1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/TOS</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/TOS?privacy=true</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://addons-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://addons.gsuite.google.com/client</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://admin.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://appsgrowthpromo-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://client-channel.google.com/client-channel/client</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://client-side-encryption.google.com/meet/init</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://client-side-encryption.google.com/oidc/meet/callback</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://clients4.google.com/invalidation/lcs/client</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://connect.corp.google.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/picker</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://meet.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://meet.google.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://meet.google.com/tel/meb-jyvf-qsy</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://meet.google.comv1_meetings</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://myaccount.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://myphonenumbers-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://slides-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://slides-pa.clients6.google.comAIzaSyCG_6Rm6c7ucLr2NwAq33-vluCp2VfSkf0v1internal</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://takeout.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://videoconf.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://workspace.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://workspaceui-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.google.com/js/bg/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>accounts.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>addons-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>addons.gsuite.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>admin.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>appsgrowthpromo-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>client-channel.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>client-side-encryption.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>clients4.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>connect.corp.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>docs.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>meet.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>meet.google.comv1_meetings</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>myaccount.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>myphonenumbers-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>slides-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>slides-pa.clients6.google.comAIzaSyCG_6Rm6c7ucLr2NwAq33-vluCp2VfSkf0v1internal</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>takeout.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>videoconf.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>workspace.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>workspaceui-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.13.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.129</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.217.112.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.84</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>0b84bc6d5bf0779eea8d6219148b60fc3c75a4e688bd5f89babf39f9041eb0ce</SHA-256>
              <SHA-1>c84c7c74ec102138cc4666d36dcf10567a11cd8b</SHA-1>
              <MD5>ff75f789641cd28bdc6c37f428013c44</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>300882ab4d7e0b0733c1bb2d513eab65484abc8534f8026d7f92db3485316c4d</SHA-256>
              <SHA-1>4004453acd5e96f149892cbedc5e74fa89ad7e3d</SHA-1>
              <MD5>4c49f755316bf6341bd5403ec499b828</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>3b3fce4c4ab65d4d008ad7d9fb42b3ea52ffe669fa496fc86c97bc7460f302a8</SHA-256>
              <SHA-1>e2dabeaced88893ca50dbd02cd2c3983a5672749</SHA-1>
              <MD5>3d1670e91b8d585b57941adba750e73d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>702708d30c092132eb312bfd82c76dd8ea6401313fb377c294181ad6043be318</SHA-256>
              <SHA-1>d7cb5257bd7bd87b44f3931f6862b75965f05ea6</SHA-1>
              <MD5>6a63fe01677cfb0678f7987dfe9d65ed</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>cf8367df36a53f70ad96208a38b94e6596496705ee56a1aa46e27ce87128a995</SHA-256>
              <SHA-1>0f42e3f58b61c186ee0dde4ff3d28db72613e127</SHA-1>
              <MD5>98792322cba2960cd50f69c6bf89f05c</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>58c583fa3fed7c94e391b311d65ee089ce6411db96d1aa83a0d0d8fc85dcdb7e</SHA-256>
              <SHA-1>6c35e258a25e0b8d0a46c330beb93f6872714c84</SHA-1>
              <MD5>c7839fad827373042d10e076b5de2ada</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>0053e8ad315ce9435cfb3040e0ae87fddc3ccc2ba595c7910cb0621f7a996e04</SHA-256>
              <SHA-1>26f82a6f82634f75af59b7efa9487d9dd9d3ed70</SHA-1>
              <MD5>cf60c5ebe7a041c42720b2a900a9cc4b</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>x697b8:$btc: 1yXrfowypwZURRTtsBDwz3iTvxH</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>hxxps://tel.meet/meb-jyvf-qsy?pin=9873753615312&amp;hs=7</name>
        <report_id>e58c5afa-228d-450e-976b-0dc764b1ea14</report_id>
        <tags>
          <value>html</value>
          <value>base64</value>
          <value>obfuscated</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>3db1b67ea56e830924ae3ddf068a0743eda2848b9b63e60df0aea7f326c5466a</id>
    <title>Analysis Report for 3db1b67ea56e830924ae3ddf068a0743eda2848b9b63e60df0aea7f326c5466a</title>
    <updated>2026-08-20T21:46:03Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87767749c2438a47b72af1</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8775925a70bef4cd151bb0</flow_id>
        <hash>3db1b67ea56e830924ae3ddf068a0743eda2848b9b63e60df0aea7f326c5466a</hash>
        <iocs>
          <urls>
            <value>
              <url>https://support.google.com/calendar/answer/37135#forwarding</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://support.google.com/calendar/answer/37135&amp;ec=GAZAdQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.google.com/support/websearch/bin/answer.py?hl=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/1998/Math/MathML</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/1999/xhtml</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/1999/xlink</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2000/svg</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/XML/1998/namespace</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/AccountChooser</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?hl=en&amp;passive=true&amp;continue=http://support.google.com/calendar/answer/37135&amp;ec=GAZAdQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ads.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://apis.google.com/js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://content-googleapis-staging.sandbox.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://content-googleapis-test.sandbox.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Google+Sans+Text:wght@400;500;700&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Noto+Color+Emoji&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/ogw/default-user=s83</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://moltron-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://myaccount.google.com/privacypolicy?hl=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ogads-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ogs.google.com/widget/callout?eom=1%5Cu0026dc=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://play.google.com/log?format=json&amp;hasfast=true</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://policies.google.com/terms</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://policies.google.com/terms/generative-ai</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://policies.google.com/terms?hl=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://support.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://support.google.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/calendar/answer/37135</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/calendar/answer/37135?co=GENIE.Platform%3DAndroid</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/calendar/answer/37135?co=GENIE.Platform%3DDesktop</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/calendar/answer/37135?co=GENIE.Platform%3DiOS</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/calendar/answer/37135?hl=en&amp;co=GENIE.Platform%3DiOS</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/communities/answer/7424249</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/communities/answer/7425194</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/embed/ads/chat/install</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/embed/ads/chat/install?</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/embed/tagging/install</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/google-ads/marketing-advisor</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/google-ads/workflow/14159772</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/google-ads/workflow/14159772https://support.google.com/google-ads/workflow/14282534https://support.google.com/google-ads/workflow/15498105</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/google-ads/workflow/14282534</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/google-ads/workflow/15498105</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/helpguide/answer/16341349</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://supporttagging-autopush.sandbox.google.com/embed/tagging/install</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://tagassistant.google.com/extension_install</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/analytics.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/accounts/TOS</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/recaptcha/api.js?trustedtypes=true&amp;onload=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/recaptcha/api.js?trustedtypes=true&amp;onload=&amp;render=explicit&amp;hl=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/recaptcha/api.js?trustedtypes=true&amp;render=explicit&amp;onload=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/tools/feedback</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googleapis.com/youtube/v3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.googleapis.com/youtube/v3/videos?part=snippet%2C+id&amp;key=AIzaSyD-4tE5aKFZYIS_IrfpCDRsgQZbv5VCJZM&amp;id=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-H30R9PNQFN</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/og/_/js/k=og.qtm.en_US.1XWJXUlYvhk.2019.O/rt=j/m=q_dnp,q_sf_gm3,q_pc,qmd,qcwid,qapid,qads/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvi59RQ6u6bH649CP9TyvyZ-AZE1Q</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/og/_/ss/k=og.qtm.8iibR_VTNAo.L.W.O/m=q_sf_gm3,qmd,qcwid,d_b_gm3,d_wi_gm3,d_lo_gm3/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTvhavHc_5TUTFiGUMBQhET_neaHtQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/uservoice/feedback/client/web/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/uservoice/feedback/client/web//main_binary__.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/uservoice/feedback/client/web//main_light_binary.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/embed/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>accounts.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ads.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>apis.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>content-googleapis-staging.sandbox.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>content-googleapis-test.sandbox.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>google-analytics.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>lh3.googleusercontent.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>moltron-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>myaccount.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ogads-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ogs.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>play.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>policies.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>support.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>supporttagging-autopush.sandbox.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>tagassistant.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.gstatic.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.w3.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.250.154.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.81</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.99</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.84</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.132</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>9de71eb2bf2afaa4203650cc26bb151c369c61d6677db6c1b44d484137244bb9</SHA-256>
              <SHA-1>e15294a8d42e0d51f188efffaa8124cebb50a82c</SHA-1>
              <MD5>30341d5d2560ecf5a1f67504973239c1</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>7ef0b37e25d99bcfaf9bcad3f8ad4b0320d652757f89083daf0cd7399eabb036</SHA-256>
              <SHA-1>66dd8f1f82be79faf3b402d5a6e15a084d165fa2</SHA-1>
              <MD5>92d56c0f2d590930fc2e5167511f85d1</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>7c5fda4188f3c811d6b0a9438c8b03957a1fc80dcd1d6f4cf8317833282851eb</SHA-256>
              <SHA-1>50206d29d869222723bb4e15ffb0df32ee695948</SHA-1>
              <MD5>cfd24b96019aab5cfdc6bcef4bcf1cfb</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>0092d4402bb2b2cb5c76fc1a03d51f19aac494d4edc36e7fc57f6ced7d3f82fa</SHA-256>
              <SHA-1>6daa42b4c754d944bcd5b9876528c5e0089d5b01</SHA-1>
              <MD5>71bad42fe939e8bfdf5fc08f5dd7f077</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>011b40e65d5749fa68470e552cff78a769adf4b10d574c27cd91ef49f84b8633</SHA-256>
              <SHA-1>1c97e6090be5e5aa14b3a6b7aa007eb49b252cac</SHA-1>
              <MD5>fa3695cb8d1a47b0fe8e8bd6e70db694</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>1eb0739c1b11246f96a033a541b1768403ccacd14179b6ce866fb659228b5054</SHA-256>
              <SHA-1>7c6d1efd4fd2a769be58849b50c7c199a799a08d</SHA-1>
              <MD5>7b5375de6fd389e4336e2a9eef148293</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>332f6ae41f9cfcfd5f415b4e3e337a10a127b14b355744f492bcc3e9cab28e13</SHA-256>
              <SHA-1>e903dca05e9f83a22f467f6eca321e637dec07d0</SHA-1>
              <MD5>00731041232280273a96d64d167e2941</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>0fd72220d5bca62b1e952a7e0c82c1543a2a1a722096385bc7ffec16c0c412a1</SHA-256>
              <SHA-1>2dba5f0db8c86be4abb69e6f13f3db6a9388e997</SHA-1>
              <MD5>ff8885ca4bc7177eda98b649bfe00450</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1d4ea0d7-372d-4c08-96ce-f9283c54579f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://support.google.com/calendar/answer/37135#forwarding</name>
        <report_id>f9013163-715b-400f-8559-6d661e97098e</report_id>
        <tags>
          <value>html</value>
          <value>base64</value>
          <value>obfuscated</value>
          <value>captcha</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>abf7bb453c2c91fbfbbc720027716dbb75fd49ce39f65494d293281ebe680ef2</id>
    <title>Analysis Report for abf7bb453c2c91fbfbbc720027716dbb75fd49ce39f65494d293281ebe680ef2</title>
    <updated>2026-08-20T21:46:03Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87763f49c2438a47b72ae3</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8775925a70bef4cd151bb1</flow_id>
        <hash>abf7bb453c2c91fbfbbc720027716dbb75fd49ce39f65494d293281ebe680ef2</hash>
        <iocs>
          <urls>
            <value>
              <url>https://calendar.google.com/calendar/r?eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://meet.google.com/meb-jyvf-qsy</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://tel.meet/meb-jyvf-qsy?pin=9873753615312&amp;hs=0</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.google.com/intl/en/googlecalendar/about.html</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://calendar.google.com/calendar/event?action=RESPOND&amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;rst=1&amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;ctz=America/Los_Angeles&amp;hl=en&amp;es=0</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>calendar.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>meet.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>tel.meet</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>ccorbett@esri.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>riley@bridgeitconsulting.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>142.251.152.119</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>d1a1a12e28a838040147bed403f52c17533b32c718d9c253617d8252350874e6</SHA-256>
              <SHA-1>420bce39e8c6d9020dfb904e22a78978351c195d</SHA-1>
              <MD5>d0019430560f6e42cfec89b91a17ab8e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>54bcb09816a434242ab65d7be1d6c564f7720d616ecf5d9435b4d34f299ec37a</SHA-256>
              <SHA-1>c50125e1a3de1baac169296afc9883feae32cbab</SHA-1>
              <MD5>ed6b51febe8578238d1256ba7945739a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>e51344172bddce7076b076722771e5c7beddd2032088c23e9ba9cdae3e24075c</SHA-256>
              <SHA-1>b70185daf991fd9cdd12082e68a21cfb59310db6</SHA-1>
              <MD5>84a2c7bbf458cd06bc9db1fd0eb3ad7f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>6c488c37bbe22936c0400ed967c09d2b8fb2c68c2bbb8570b5f84389cb713eb1</SHA-256>
              <SHA-1>b9c33eebbd37a4dc86089145e0a9a1d3fac92339</SHA-1>
              <MD5>620c0db4c53738846ee5706019636069</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://calendar.google.com/calendar/event?action=RESPOND&amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;rst=1&amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;ctz=America/Los_Angeles&amp;hl=en&amp;es=0</name>
        <report_id>accada59-067d-466f-86b9-8fda280bff75</report_id>
        <tags>
          <value>html</value>
          <value>obfuscated</value>
          <value>captcha</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f72b5a3dcb57ed841c8d112300e346aa11722104ec4b0be67b597dc71533d8a8</id>
    <title>Analysis Report for f72b5a3dcb57ed841c8d112300e346aa11722104ec4b0be67b597dc71533d8a8</title>
    <updated>2026-08-20T21:46:02Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8775f749c2438a47b72acc</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877592009ae7a1a8d2ded7</flow_id>
        <hash>f72b5a3dcb57ed841c8d112300e346aa11722104ec4b0be67b597dc71533d8a8</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schema.org/HttpRequestMethod/GET</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/HttpRequestMethod/GET</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/favicon.ico</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>schema.org</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.250.154.139</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxp://schema.org/HttpRequestMethod/GET</name>
        <report_id>93ec996c-1792-497d-94e1-221dd8c65d59</report_id>
        <tags>
          <value>html</value>
          <value>aidetect</value>
          <value>phishing</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ecb3b4b9f8bc076dae524a3f4e50542e314b6576b202ca1cd7a9d1f030d8722a</id>
    <title>Analysis Report for ecb3b4b9f8bc076dae524a3f4e50542e314b6576b202ca1cd7a9d1f030d8722a</title>
    <updated>2026-08-20T21:46:02Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87767f49c2438a47b72af4</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8775935a70bef4cd151bb4</flow_id>
        <hash>ecb3b4b9f8bc076dae524a3f4e50542e314b6576b202ca1cd7a9d1f030d8722a</hash>
        <iocs>
          <urls>
            <value>
              <url>https://calendar.google.com/calendar/r?eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://meet.google.com/meb-jyvf-qsy</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://tel.meet/meb-jyvf-qsy?pin=9873753615312&amp;hs=0</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.google.com/intl/en/googlecalendar/about.html</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://calendar.google.com/calendar/event?action=RESPOND&amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;rst=3&amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;ctz=America/Los_Angeles&amp;hl=en&amp;es=0</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>calendar.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>meet.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>tel.meet</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>ccorbett@esri.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>riley@bridgeitconsulting.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>142.251.150.119</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>8f71193324aaca48a3ab2eb25348af97c5e53457e31633052c7fec310a219c9b</SHA-256>
              <SHA-1>67fb9ad8854b01a9d922441762d90df297ee1396</SHA-1>
              <MD5>0baec269d76d74c17e453e594c406486</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>eeef8d3cb5b7da32771bb6dc62e675331629a3e5a19612f0ef054fbd01a8c48a</SHA-256>
              <SHA-1>7ddcb4660508945cace663b73c6d22a7a730a5ce</SHA-1>
              <MD5>cb2475a4cced80d31df3c9d69f59d292</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>77db8098a89665a71f3c66e51750cd6ee7dc7c38bc020668020f386b96fb2874</SHA-256>
              <SHA-1>03f6c29f7b583f715aed15cb43445190a972e40e</SHA-1>
              <MD5>8bc2de12da87faca2682d5b93be4d83c</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>18e58ffa4a477d90f05e239a71ac1ef7dca2cb7d1666cc216f3b037beb9db518</SHA-256>
              <SHA-1>d989d3bfc90fd7302824ed3f8f9a93ebcec10642</SHA-1>
              <MD5>59eb8d0447e1c51c304b47908eb2677a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://calendar.google.com/calendar/event?action=RESPOND&amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;rst=3&amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;ctz=America/Los_Angeles&amp;hl=en&amp;es=0</name>
        <report_id>92092852-759b-4dc7-bf1c-3c088c74021b</report_id>
        <tags>
          <value>html</value>
          <value>obfuscated</value>
          <value>captcha</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>30be32b82bdb20e546caa6b5ec459bd87380f98b6976f5105af41b58a331008d</id>
    <title>Analysis Report for 30be32b82bdb20e546caa6b5ec459bd87380f98b6976f5105af41b58a331008d</title>
    <updated>2026-08-20T21:46:01Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87760e49c2438a47b72ad5</_id>
        <file_type>image/png</file_type>
        <flow_id>6a8775930dfb99c1ceb0995a</flow_id>
        <hash>30be32b82bdb20e546caa6b5ec459bd87380f98b6976f5105af41b58a331008d</hash>
        <iocs>
          <urls>
            <value>
              <url>https://fonts.gstatic.com/s/i/googlematerialiconsfilled/encrypted/v3/gm_grey200-24dp/2x/gm_filled_encrypted_gm_grey200_24dp.png</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
        </iocs>
        <name>hxxps://fonts.gstatic.com/s/i/googlematerialiconsfilled/encrypted/v3/gm_grey200-24dp/2x/gm_filled_encrypted_gm_grey200_24dp.png</name>
        <report_id>bd26e6e7-6dc8-40bc-a113-c92f7d48f70d</report_id>
        <tags>
          <value>png</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>6f95fceabfb79c4836725d1ff98b453748805e04a65ea7b348388f6ca26d2ea5</id>
    <title>Analysis Report for 6f95fceabfb79c4836725d1ff98b453748805e04a65ea7b348388f6ca26d2ea5</title>
    <updated>2026-08-20T21:46:01Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87760d49c2438a47b72ad4</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8775930dfb99c1ceb0995d</flow_id>
        <hash>6f95fceabfb79c4836725d1ff98b453748805e04a65ea7b348388f6ca26d2ea5</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schema.org/RsvpAttendance/No</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
        </iocs>
        <name>hxxp://schema.org/RsvpAttendance/No</name>
        <report_id>2ccd03c0-1e1c-470d-b3a0-a29fe9db1dfb</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ca2e592cf0d81d6ed8972d7f049b1655622a5b9f296630de732b852709eb2bce</id>
    <title>Analysis Report for ca2e592cf0d81d6ed8972d7f049b1655622a5b9f296630de732b852709eb2bce</title>
    <updated>2026-08-20T21:46:01Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87761149c2438a47b72ad6</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8775935a70bef4cd151bb6</flow_id>
        <hash>ca2e592cf0d81d6ed8972d7f049b1655622a5b9f296630de732b852709eb2bce</hash>
        <iocs>
          <urls>
            <value>
              <url>http://en.wikipedia.org/wiki/ISO_8601</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://en.wikipedia.org/wiki/ISO_8601)).</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://en.wikipedia.org/wiki/ISO_8601).</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#description</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#image</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#title</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#url</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/dcam/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/dcmitype/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/elements/1.1/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/linked-data/cube#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/vocab/vann/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://rdfs.org/ns/void#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://tools.ietf.org/html/bcp47</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://tools.ietf.org/html/bcp47).</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://usefulinc.com/ns/doap#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.opengis.net/ont/geosparql#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.w3.org/1999/02/22-rdf-syntax-ns#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2000/01/rdf-schema#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2001/XMLSchema#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2002/07/owl#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2004/02/skos/core#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2006/time#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/csvw#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/dcat#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/dx/prof/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/odrl/2/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/org#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/prov#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/shacl#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/sosa/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/ssn/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://xmlns.com/foaf/0.1/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://brickschema.org/schema/Brick#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/JSON-LD</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/Microdata_(HTML)</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/RDFa</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/examples.txt%20%7D%7D</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/ext/pending/issue-1050-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/ext/pending/issue-1457-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/ext/pending/issue-1842-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-sponsor-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-sponsor-examples.txt%20%7D%7D</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-tourism-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-tourism-examples.txt%20%7D%7D</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/1457</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/1670</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/1698</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/1842</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2289</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2382</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2486</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/3617</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/383</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/4495</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/4588</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/4603</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues?q=is%3Aissue+is%3Aopen+Event</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://pending.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/description</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/Event</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/collab/MBZ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/collab/TP</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/styleguide.html</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/terms.html</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/FND/DatesAndTimes/Occurrences/Occurrence</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/FND/ProductsAndServices/ProductsAndServices/isProductOf</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://validator.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/DatesAndTimes/hasEndDate</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/DatesAndTimes/hasStartDate</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Identifiers/identifiedBy</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Locations/isLocatedIn</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Quantities/hasUpperBound</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Text/hasName</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.w3.org/2003/01/geo/wgs84_pos#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/Event</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>ajax.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>brickschema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>en.wikipedia.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ogp.me</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>pending.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>purl.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rdfs.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ref.gs1.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>spec.edmcouncil.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>tools.ietf.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>usefulinc.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>validator.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.omg.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.opengis.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.w3.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>xmlns.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>207.241.225.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.108.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>75.2.60.5</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>217.154.231.107</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.67.74.82</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.121.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>216.239.36.21</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.15.59.224</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.16.45.99</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.22.19</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>52.73.243.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>78.153.210.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>da755972e26d0f8b704ec8599c5b407176d35e7e2de3b30f30a080b61723c555</SHA-256>
              <SHA-1>3efe20799648e73638f228940d4f80f2b706695a</SHA-1>
              <MD5>3d92a830ebcfb5664ff6f4ef7f647a08</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxp://schema.org/Event</name>
        <report_id>28aced05-2546-4b0e-af48-33fcfb62cab3</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>619708f90659e08038cd86f8e1c1910f707e10e5d53aabc981ac3c9bf1c26fec</id>
    <title>Analysis Report for 619708f90659e08038cd86f8e1c1910f707e10e5d53aabc981ac3c9bf1c26fec</title>
    <updated>2026-08-20T21:46:00Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87760c49c2438a47b72ad2</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877593009ae7a1a8d2dedc</flow_id>
        <hash>619708f90659e08038cd86f8e1c1910f707e10e5d53aabc981ac3c9bf1c26fec</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schema.org/RsvpAttendance/Maybe</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
        </iocs>
        <name>hxxp://schema.org/RsvpAttendance/Maybe</name>
        <report_id>b91890e0-2cc9-4974-8247-6ac61fbc6160</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>79cca0579d4ee5caf0042ba3a0af9b8dc2e9866b7d11946005787e9cfb4d2e26</id>
    <title>Analysis Report for 79cca0579d4ee5caf0042ba3a0af9b8dc2e9866b7d11946005787e9cfb4d2e26</title>
    <updated>2026-08-20T21:46:00Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87764649c2438a47b72ae5</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8775930dfb99c1ceb09960</flow_id>
        <hash>79cca0579d4ee5caf0042ba3a0af9b8dc2e9866b7d11946005787e9cfb4d2e26</hash>
        <iocs>
          <urls>
            <value>
              <url>https://accounts.google.com/AccountChooser?hl%5Cu003den-US</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/Logout?hl%5Cu003den-US</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?ltmpl%5Cu003dmeet%5Cu0026osid%5Cu003d1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/TOS</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/TOS?privacy=true</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://addons-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://addons.gsuite.google.com/client</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://admin.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://appsgrowthpromo-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://client-channel.google.com/client-channel/client</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://client-side-encryption.google.com/meet/init</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://client-side-encryption.google.com/oidc/meet/callback</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://clients4.google.com/invalidation/lcs/client</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://connect.corp.google.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/picker</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://meet.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://meet.google.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://meet.google.com/tel/meb-jyvf-qsy</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://meet.google.comv1_meetings</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://myaccount.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://myphonenumbers-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://slides-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://slides-pa.clients6.google.comAIzaSyCG_6Rm6c7ucLr2NwAq33-vluCp2VfSkf0v1internal</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://takeout.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://videoconf.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://workspace.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://workspaceui-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.google.com/js/bg/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://tel.meet/meb-jyvf-qsy?pin=9873753615312&amp;amp;hs=0</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>accounts.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>addons-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>addons.gsuite.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>admin.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>appsgrowthpromo-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>client-channel.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>client-side-encryption.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>clients4.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>connect.corp.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>docs.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>meet.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>meet.google.comv1_meetings</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>myaccount.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>myphonenumbers-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>slides-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>slides-pa.clients6.google.comAIzaSyCG_6Rm6c7ucLr2NwAq33-vluCp2VfSkf0v1internal</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>takeout.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>videoconf.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>workspace.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>workspaceui-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.127.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.129</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.84</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.217.112.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>36c5c7f7609a88a856779388e2f2e2177fc5b0273e4a794d7fa8882d5fa1d5dd</SHA-256>
              <SHA-1>c77b50c8ffd344f3aef5495347cb4a13df90024b</SHA-1>
              <MD5>42ef71b7b719693128546dfcaa755d50</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>eba45af91a66240d68bb02f25efc1e39b8d821bf7e23e22e3a2f89da05a932f0</SHA-256>
              <SHA-1>50e18ddce0ea9f4dc66c2b59c76d306a860c1b20</SHA-1>
              <MD5>88282ea865671afed4937bbaed211f26</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>f9411235318e3c11321c4477407a259038ef2703ef43c7b6b955e04d22a18fe2</SHA-256>
              <SHA-1>46d23c4e4cf2b0ce7ccb15985cdd53a5b4089b3d</SHA-1>
              <MD5>ade8740e2ea817c9959442e7c27fda83</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>6fe6d26499225fb781cd253b84f4d8e5b3d5759984516d5764f4ee92413fda9c</SHA-256>
              <SHA-1>62e00974346bd1e2994feed3bb91b2f5546fb7a2</SHA-1>
              <MD5>233bb4a270029e51f9117cd8474b081d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>8314ceba28417ec6e525368315260da0f0f192e2c44bf108d2980a12cd29707c</SHA-256>
              <SHA-1>7f3ce7c4547d9d296e08b2824e1c69c2fb5810ab</SHA-1>
              <MD5>9082269a519d31ce76c7294b49ec473d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>8dbefb7416db77c06f6862ee960ef3e72c7e54ce6e77064be5f5cb0952f2a646</SHA-256>
              <SHA-1>151da2081f6c6dcbbc337d1ac7566007d9045564</SHA-1>
              <MD5>417fae85a4d829b4553a09adf0c9f501</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>da8d55192169cbb246b54d89cfd9637216a5842cbbb2f42ce16545f2156c8b62</SHA-256>
              <SHA-1>937f2e092a63fd8ce8b87bf13c17cd0c6785f058</SHA-1>
              <MD5>cb7b3f738ab1c2e37d752ab5b8540530</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>x67e32:$btc: 18B8tLPpUST1vJYs9FfNomnSKdxa</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>hxxps://tel.meet/meb-jyvf-qsy?pin=9873753615312&amp;amp;hs=0</name>
        <report_id>c19c4971-5097-4a49-9be0-c4c69e16b960</report_id>
        <tags>
          <value>html</value>
          <value>base64</value>
          <value>obfuscated</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>fd67611eed1acffc7281e9ce62b0a860031a7becf61fdec2d1b80703db3732e7</id>
    <title>Analysis Report for fd67611eed1acffc7281e9ce62b0a860031a7becf61fdec2d1b80703db3732e7</title>
    <updated>2026-08-20T21:46:00Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8775d349c2438a47b72ac1</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8775931d88974f46c408e2</flow_id>
        <hash>fd67611eed1acffc7281e9ce62b0a860031a7becf61fdec2d1b80703db3732e7</hash>
        <iocs>
          <urls>
            <value>
              <url>http://ogp.me/ns#description</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#image</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#title</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#url</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/dcam/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/dcmitype/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/elements/1.1/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/linked-data/cube#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/vocab/vann/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://rdfs.org/ns/void#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://tools.ietf.org/html/bcp47</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://tools.ietf.org/html/bcp47).</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://unece.org/vocab#ServiceProvider</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://usefulinc.com/ns/doap#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.opengis.net/ont/geosparql#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.w3.org/1999/02/22-rdf-syntax-ns#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2000/01/rdf-schema#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2001/XMLSchema#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2002/07/owl#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2004/02/skos/core#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2006/time#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/csvw#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/dcat#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/dx/prof/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/odrl/2/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/org#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/prov#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/shacl#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/sosa/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/ssn/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://xmlns.com/foaf/0.1/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://blog.schema.org/2014/04/16/announcing-schema-org-actions/)</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://brickschema.org/schema/Brick#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/JSON-LD</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/1670</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2289</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2382</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2493</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2927</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/4588</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/4603</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues?q=is%3Aissue+is%3Aopen+InformAction</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://pending.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/description</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://schema.org/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/InformAction</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://schema.org/docs/actions.html).</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/collab/ActionCollabClass</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/styleguide.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://schema.org/docs/terms.html</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://validator.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Identifiers/identifiedBy</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Locations/isLocatedIn</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Text/hasName</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.w3.org/2003/01/geo/wgs84_pos#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/InformAction#eg-0096</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://tools.ietf.org/html/bcp47</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://clients1.google.com/generate_204</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cse.google.com/adsense/search/async-ads.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://cse.google.com/cse.js?cx=013516846811604855281:nj5laplixaa</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/JSON-LD</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&amp;tid=afs&amp;tv=1234567890&amp;st=env&amp;sjk=qM4YRzT1TYS/TavMevyN6A==&amp;sde=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&amp;v=255&amp;t=2&amp;li=afs_1234567890&amp;jk=qM4YRzT1TYS%2FTavMevyN6A%3D%3D&amp;bg=!uLulu9nNAAYssmaFDLI7AEcBe5WfON7-2v-7joagH25EBCAxn7k755-n_L7KRgmuZ8rIY9RA_QbX4HrYkPUwL_kifB-q_AbMOGIkEOMFBW6xzqC5TLbV7gIAAAAwUgAAAARoAQd-ABuE3jKwlmUc-Kuw2paaxeLdee4eNxENlBb_m4YKAFS-AwWXNxd6NkVCwJ2xheiKnKtbel5h8rYdsbzqMqJPFeZFtBJXkRwF7_pFHpWzzysizuBCoGFVoZ7TLQzy6-gpxXp_9C2xxnu2aHAyUoxShaIxmnGZAaunmVaWkAX7wSry071BOkE10I3JtRrc0OdyZ5m1O7ab3wdw6C52JRiavY1tSq3dv4niZJf2N-tG1-kpnRPXKQmhdHQ-c_X_fticdNJj0BI8CIfcCbCZHLTTdUBgezymTOVfhzoR17Qr_pY7EeZi5enacNDFhEZPdo0FWbbnj-BuarsK1tZaPTEDRtyvKrHAqKvZkeabcgEbvMkq2NjRCJU2LR2BYiAnop9cxHhQ4Z0CkbAwCnH2LpobcTGMjw-S04YZQ27wY84unvXIkFDIayV6pwmutivUSHqIKjyJIsEK9ywao3yRO_NWT5LBqu7FDqOG_iO2yF-7UObH_gC-NG__GDnjH0trb9BFuyIr0OQT_GNigk2oMwoR46R99hz-XkA9tLpIIwFV4FzeeMcj_aaY1nAo5sS-iOR9HM8vFFry2XLkY3dFOVZ9TD109HuGx1VRf7tOnMC4-ZZ17N3rArDMIl63YtxXz1Y4PKOl-V0x0DMB3BmfZ8Z2-jZyvRReAe4LOXLwz1mt6j81fWSEMF-nUqjdXu4SuZYC0ewZsHXMUKsjzPVqTuUIsk36</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ep2.adtrafficquality.google/sodar/sodar2.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ep2.adtrafficquality.google/sodar/sodar2/255/runner.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Manrope:wght@200..800&amp;family=Noto+Sans+Mono:wght@500..700&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/notosansmono/v37/BngcUXNETWXI6LwhGYvaxZikqZqK6fBq6kPvUce2oAZ2evCj.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues?q=is%3Aissue+is%3Aopen+InformAction</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect?v=2&amp;tid=G-7GQQMC8QW5&amp;gtm=45je68j0h1v9123064558za20g&amp;_p=1787262392639&amp;gcd=13l3l3l2l2l1&amp;npa=0&amp;dma_cps=a&amp;dma=1&amp;_eu=EBAI&amp;are=1&amp;cid=651081529.1787262393&amp;frm=0&amp;ir=1&amp;ngs=1&amp;pscdl=noapi&amp;rcb=8&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;_s=1&amp;tag_exp=115616986~115938465~115938468~118897920~118897930~119367802~119367810~120315471~120385422&amp;dl=https%3A%2F%2Fschema.org%2FInformAction&amp;dt=InformAction%20-%20Schema.org%20Type&amp;sid=1787262392&amp;sct=1&amp;seg=0&amp;en=page_view&amp;_fv=1&amp;_ss=1&amp;_ee=1&amp;tfd=444</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/InformAction</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/clipboard/clipboard.min.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/clipboard/clippy.svg</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/devnote.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/favicon.ico</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/prettify.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/prettify.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/pretty-markup/layout.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/pretty-markup/schemarama-parsing.bundle.min.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/pretty-markup/style.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/schemaorg.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/schemaorg.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/sdotermpage.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/sdotermpage.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/styleguide.html</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://validator.schema.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google-analytics.com/analytics.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect?v=1&amp;_v=j102&amp;a=1240511106&amp;t=pageview&amp;_s=1&amp;dl=https%3A%2F%2Fschema.org%2FInformAction&amp;ul=en-us&amp;dt=InformAction%20-%20Schema.org%20Type&amp;sr=800x600&amp;vp=1905x1080&amp;_u=IEBAAEABAAAAACAAI~&amp;jid=848329764&amp;gjid=1735705601&amp;cid=651081529.1787262393&amp;tid=UA-52672119-1&amp;_gid=763583891.1787262393&amp;_r=1&amp;_slc=1&amp;z=144728442</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/css/v2/clear.png</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/element/93e57cb47c499c53/cse_element__en.js?usqp=CAM%3D</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/element/93e57cb47c499c53/default_v6+en.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/images/1x/en/branding.png</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/style/look/v6/espresso.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-7GQQMC8QW5&amp;cx=c&amp;_slc=1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>Schema.org</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/InformAction&amp;dt=InformAction</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/InformAction&amp;ul=en-us&amp;dt=InformAction</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/InformAction</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>ajax.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>blog.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>brickschema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>en.wikipedia.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ogp.me</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>pending.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>purl.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rdfs.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ref.gs1.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>tools.ietf.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>unece.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>usefulinc.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>validator.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.omg.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.opengis.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.w3.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>xmlns.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ajax.googleapis.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>clients1.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cse.google.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>en.wikipedia.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ep1.adtrafficquality.google</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ep2.adtrafficquality.google</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>region1.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>tools.ietf.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>validator.schema.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>185.199.108.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.111.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.26.3.27</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.121.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>75.2.60.5</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.20.26.191</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.15.59.224</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>78.153.210.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.100</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.250.154.102</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.132</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.13.101</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.157.119</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.102</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.157</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>216.239.34.36</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>217.154.231.107</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.16.45.99</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.0.78.233</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.23.19</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>207.241.225.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>216.239.38.21</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>634b309b4f98a394a1e1b4c81ed6748baf6561ed16b6c96b22085dff1ccfca65</SHA-256>
              <SHA-1>709d7f5f5014a43d423c64ac53fb905817c59620</SHA-1>
              <MD5>d79bf9d5ea0ff77d6e16670a244c3141</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>413d294fad14524bf94e764b33ff0f327682549408545171fcf9240189c154ae</SHA-256>
              <SHA-1>f30daebcb81f94af5e6dfd9e70585b8904d72ac1</SHA-1>
              <MD5>7f44c7691673d77d8557d4d5699ef23a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxp://schema.org/InformAction</name>
        <report_id>1906ae54-50d8-45df-9246-ad28ba88c75a</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0f054093c099defa5c6d0dec2a5d8fef9070766e3b2678a731a0de1f24fa3204</id>
    <title>Analysis Report for 0f054093c099defa5c6d0dec2a5d8fef9070766e3b2678a731a0de1f24fa3204</title>
    <updated>2026-08-20T21:45:59Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8775d849c2438a47b72ac3</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877593099a97c449ef4ae7</flow_id>
        <hash>0f054093c099defa5c6d0dec2a5d8fef9070766e3b2678a731a0de1f24fa3204</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schema.org/RsvpAction#eg-0098</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://tools.ietf.org/html/bcp47</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://clients1.google.com/generate_204</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cse.google.com/adsense/search/async-ads.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://cse.google.com/cse.js?cx=013516846811604855281:nj5laplixaa</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/JSON-LD</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&amp;tid=afs&amp;tv=1234567890&amp;st=env&amp;sjk=epf9A+GBTAa1tP/xqIeWVw==&amp;sde=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&amp;v=255&amp;t=2&amp;li=afs_1234567890&amp;jk=epf9A%2BGBTAa1tP%2FxqIeWVw%3D%3D&amp;bg=!Li2lLU_NAAYssmaFDLI7AEcBe5WfOEKfgbI-7PtEo2ZZAKPy-PNmaYbxh15m2QnA6gXibA-m-64zZfEtuc7AR3IhTQeASSryQ-06iYX0wtDvpwGtTXBykwIAAAA6UgAAAAVoAQd-ABuIIXAcl7rAQiv7D3sGlZ643IqjFmIi2n_Zo1AKACelthk2t4yoFkzUK4vseq8k7HSGprhfJFtPnV7vgUIq4Mnn1LmVIAKZAasWNKOp4mF-hTmDqo-QFmJFjKyEbhIAowk283p2NHdR6B0TuQV5FTpzasOjv6Qw-tRefgNarf8BdnTp0hR07yuBGWKNAXxgcNCWWd96a98BQ_ecOSZ4EG_XACSZpEQcY6dd8mQUK0za1d2xknHinDWV_Yy7cbitS3L6UkjZRPlg9i8aL6dsDjJbwn2xGBaJjG8mxurxZnl3MtNvVk7veBtnUdopl016bEwGsNckpyv3Ln8Pm2NFyIhwm0N7kwiGErlgW3zam-1JfM80LLhQc-H6DkzQ00GrZZFMEYKr1ziCNRE_q4LgeAfLmsVobLu8pNhUmLZORnU6oeitXVwfqcvWtPHnojCwDWfueHz74-O4x3waY5-xM4_5BASjqkwuImIz3jiOtqK7JZ4X9SUypHoodpG639dXdE7uZdYXKbQ9En7lHyoE1_rMekJqPIXH7yy7Srme4vxkBfMikbGERQRaTYjaSDe8l_m5gwpcS-ew1bN5HPDgFNlD6_G4V8W2iLVGw3p9QurLaY3W35p9kq4KFZOg5ROy-86skn47u4wlXVYsDm3DPp661pH7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ep2.adtrafficquality.google/sodar/sodar2.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ep2.adtrafficquality.google/sodar/sodar2/255/runner.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Manrope:wght@200..800&amp;family=Noto+Sans+Mono:wght@500..700&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/notosansmono/v37/BngcUXNETWXI6LwhGYvaxZikqZqK6fBq6kPvUce2oAZ2evCj.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues?q=is%3Aissue+is%3Aopen+RsvpAction</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect?v=2&amp;tid=G-7GQQMC8QW5&amp;gtm=45je68j0v9123064558za20g&amp;_p=1787262392637&amp;gcd=13l3l3l2l2l1&amp;npa=0&amp;dma_cps=a&amp;dma=1&amp;_eu=EBAI&amp;are=1&amp;cid=1575655989.1787262393&amp;frm=0&amp;ir=1&amp;ngs=1&amp;pscdl=noapi&amp;rcb=10&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;_s=1&amp;tag_exp=115938465~115938468~118897920~118897930~119367802~119367810~120315471~120385423&amp;dl=https%3A%2F%2Fschema.org%2FRsvpAction&amp;dt=RsvpAction%20-%20Schema.org%20Type&amp;sid=1787262392&amp;sct=1&amp;seg=0&amp;en=page_view&amp;_fv=1&amp;_ss=1&amp;_ee=1&amp;tfd=437</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/RsvpAction</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/clipboard/clipboard.min.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/clipboard/clippy.svg</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/devnote.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/favicon.ico</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/prettify.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/prettify.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/pretty-markup/layout.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/pretty-markup/schemarama-parsing.bundle.min.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/pretty-markup/style.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/schemaorg.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/schemaorg.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/sdotermpage.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/sdotermpage.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/styleguide.html</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://validator.schema.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google-analytics.com/analytics.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect?v=1&amp;_v=j102&amp;a=273815456&amp;t=pageview&amp;_s=1&amp;dl=https%3A%2F%2Fschema.org%2FRsvpAction&amp;ul=en-us&amp;dt=RsvpAction%20-%20Schema.org%20Type&amp;sr=800x600&amp;vp=1905x1080&amp;_u=IEBAAEABAAAAACAAI~&amp;jid=1853334224&amp;gjid=1695082514&amp;cid=1575655989.1787262393&amp;tid=UA-52672119-1&amp;_gid=1031274594.1787262393&amp;_r=1&amp;_slc=1&amp;z=1350104401</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/css/v2/clear.png</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/element/93e57cb47c499c53/cse_element__en.js?usqp=CAM%3D</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/element/93e57cb47c499c53/default_v6+en.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/images/1x/en/branding.png</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/style/look/v6/espresso.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-7GQQMC8QW5&amp;cx=c&amp;_slc=1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>Schema.org</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/RsvpAction&amp;dt=RsvpAction</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/RsvpAction&amp;ul=en-us&amp;dt=RsvpAction</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/RsvpAction</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#description</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#image</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#title</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#url</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/dcam/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/dcmitype/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/elements/1.1/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/linked-data/cube#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/vocab/vann/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://rdfs.org/ns/void#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://tools.ietf.org/html/bcp47</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://tools.ietf.org/html/bcp47).</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://unece.org/vocab#ServiceProvider</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://usefulinc.com/ns/doap#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.opengis.net/ont/geosparql#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.w3.org/1999/02/22-rdf-syntax-ns#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2000/01/rdf-schema#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2001/XMLSchema#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2002/07/owl#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2004/02/skos/core#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2006/time#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/csvw#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/dcat#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/dx/prof/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/odrl/2/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/org#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/prov#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/shacl#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/sosa/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/ssn/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://xmlns.com/foaf/0.1/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://blog.schema.org/2014/04/16/announcing-schema-org-actions/)</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://brickschema.org/schema/Brick#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/JSON-LD</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/1670</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2289</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2382</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2493</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2927</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/4588</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/4603</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues?q=is%3Aissue+is%3Aopen+RsvpAction</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://pending.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/description</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://schema.org/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/RsvpAction</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://schema.org/docs/actions.html).</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/collab/ActionCollabClass</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/styleguide.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://schema.org/docs/terms.html</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://validator.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Identifiers/identifiedBy</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Locations/isLocatedIn</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Text/hasName</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.w3.org/2003/01/geo/wgs84_pos#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>ajax.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>blog.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>brickschema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>en.wikipedia.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ogp.me</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>pending.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>purl.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rdfs.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ref.gs1.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>tools.ietf.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>unece.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>usefulinc.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>validator.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.omg.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.opengis.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.w3.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>xmlns.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ajax.googleapis.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>clients1.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cse.google.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>en.wikipedia.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ep1.adtrafficquality.google</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ep2.adtrafficquality.google</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>region1.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>tools.ietf.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>validator.schema.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>185.199.108.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.23.19</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.16.45.99</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>75.2.60.5</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>207.241.225.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.15.59.224</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.0.78.233</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>217.154.231.107</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.101</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.132</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.13.139</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.157.119</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.102</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.157</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>216.239.34.36</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>78.153.210.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>216.239.38.21</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.121.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.20.26.191</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.111.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.26.3.27</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>413d294fad14524bf94e764b33ff0f327682549408545171fcf9240189c154ae</SHA-256>
              <SHA-1>f30daebcb81f94af5e6dfd9e70585b8904d72ac1</SHA-1>
              <MD5>7f44c7691673d77d8557d4d5699ef23a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>634b309b4f98a394a1e1b4c81ed6748baf6561ed16b6c96b22085dff1ccfca65</SHA-256>
              <SHA-1>709d7f5f5014a43d423c64ac53fb905817c59620</SHA-1>
              <MD5>d79bf9d5ea0ff77d6e16670a244c3141</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxp://schema.org/RsvpAction</name>
        <report_id>90e1340c-dd13-4f16-9a45-82f0de357d5e</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>abb14a5d3fe19d35d487879d995f2169431c7ac92495bef77ebcb3e3dfd4bd60</id>
    <title>Analysis Report for abb14a5d3fe19d35d487879d995f2169431c7ac92495bef77ebcb3e3dfd4bd60</title>
    <updated>2026-08-20T21:45:59Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87763349c2438a47b72adf</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877593009ae7a1a8d2dede</flow_id>
        <hash>abb14a5d3fe19d35d487879d995f2169431c7ac92495bef77ebcb3e3dfd4bd60</hash>
        <iocs>
          <urls>
            <value>
              <url>https://support.google.com/calendar?hl=de</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.google.com/appsstatus#v=status&amp;hl=de</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://calendar.google.com/calendar/event?action=VIEW&amp;amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;amp;ctz=America/Los_Angeles&amp;amp;hl=en&amp;amp;es=0</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>support.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.152.119</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>e0e380bf81dd6b8c58232132261748c7dc132e50c8694e5c1a6745012a4bd2c9</SHA-256>
              <SHA-1>93e2bdf21577a1ab3d10da4bfad6a0153e6ece30</SHA-1>
              <MD5>61d57d9f7af9023f54729f5260fb5ff2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>b9862c44f978eb228439e640cf22a333f9ebbc87368eda65d6869711b391a3d8</SHA-256>
              <SHA-1>762cbd6d065058a28d4b95af7d6b96a0b7f529fc</SHA-1>
              <MD5>23779e07d380c71ba3a78b98ce376cf8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://calendar.google.com/calendar/event?action=VIEW&amp;amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;amp;ctz=America/Los_Angeles&amp;amp;hl=en&amp;amp;es=0</name>
        <report_id>7f5be0c5-5bf4-4a7e-a7e5-ed01e312aa25</report_id>
        <tags>
          <value>html</value>
          <value>obfuscated</value>
          <value>captcha</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9c293fd90d2f8a7f18369946b12318e617f089097e9c59d281c26131115d2a5f</id>
    <title>Analysis Report for 9c293fd90d2f8a7f18369946b12318e617f089097e9c59d281c26131115d2a5f</title>
    <updated>2026-08-20T21:45:59Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87760949c2438a47b72ad0</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877593009ae7a1a8d2dee1</flow_id>
        <hash>9c293fd90d2f8a7f18369946b12318e617f089097e9c59d281c26131115d2a5f</hash>
        <iocs>
          <urls>
            <value>
              <url>https://calendar.google.com/calendar/event?action=RESPOND&amp;amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;amp;rst=3&amp;amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;amp;ctz=America/Los_Angeles&amp;amp;hl=en&amp;amp;es=0</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://support.google.com/calendar?hl=de</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.google.com/appsstatus#v=status&amp;hl=de</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://calendar.google.com/calendar/event?action=RESPOND&amp;amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;amp;rst=3&amp;amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;amp;ctz=America/Los_Angeles&amp;amp;hl=en&amp;amp;es=0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://calendar.google.com/calendar/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://support.google.com/calendar?hl=de</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.com/appsstatus#v=status&amp;hl=de</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/images/errors/robot.png</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>calendar.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>support.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>support.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.156.119</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.138</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.14.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.152.119</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>42de689eea437e4ec2b1562f1face8971e9cad576cf0aa32c51b7b16d652d521</SHA-256>
              <SHA-1>d516624cdbd28df15f014f8589bfb3c0d9bf0959</SHA-1>
              <MD5>082ef4ab85700dce918b8afd4287203d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>de04e23c38d0ab195471658349b14ed9dfafd95f07f5d3926abaec6c6edacb6e</SHA-256>
              <SHA-1>2ca0fbaf9d8159ccfba250e5c3bbc6f88f8d46d1</SHA-1>
              <MD5>cec2316e2043d30663d5cf6d24e54207</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://calendar.google.com/calendar/event?action=RESPOND&amp;amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;amp;rst=3&amp;amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;amp;ctz=America/Los_Angeles&amp;amp;hl=en&amp;amp;es=0</name>
        <report_id>7d0122d5-2de8-4f7a-8771-f7e06ccc27fc</report_id>
        <tags>
          <value>html</value>
          <value>obfuscated</value>
          <value>captcha</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>acff70bab32d7f1827ef9970a3304bd77ea2ca1c7f1ffedb4bb2d4d627d78507</id>
    <title>Analysis Report for acff70bab32d7f1827ef9970a3304bd77ea2ca1c7f1ffedb4bb2d4d627d78507</title>
    <updated>2026-08-20T21:45:59Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8775db49c2438a47b72ac7</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8775930dfb99c1ceb09962</flow_id>
        <hash>acff70bab32d7f1827ef9970a3304bd77ea2ca1c7f1ffedb4bb2d4d627d78507</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schema.org/Organization</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#description</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#image</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#title</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#url</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/dcam/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/dcmitype/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/elements/1.1/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/linked-data/cube#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/vocab/vann/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://rdfs.org/ns/void#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://tools.ietf.org/html/bcp47</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://tools.ietf.org/html/bcp47).</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://unece.org/vocab#ApplicableCertificate</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://unece.org/vocab#PromotionalMessage</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://unece.org/vocab#brandName</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://unece.org/vocab#dUNSId</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://unece.org/vocab#gLNId</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://unece.org/vocab#logoReferencedDocument</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://usefulinc.com/ns/doap#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.gs1.org/gln</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://www.gs1.org/gln)</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.opengis.net/ont/geosparql#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.w3.org/1999/02/22-rdf-syntax-ns#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2000/01/rdf-schema#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2001/XMLSchema#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2002/07/owl#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2004/02/skos/core#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2006/time#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/csvw#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/dcat#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/dx/prof/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/odrl/2/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/org#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/prov#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/shacl#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/sosa/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/ssn/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://xmlns.com/foaf/0.1/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://attic.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://brickschema.org/schema/Brick#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/ISO/IEC_6523</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/ISO/IEC_6523).</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/JSON-LD</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/Microdata_(HTML)</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/RDFa</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/examples.txt%20%7D%7D</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/ext/pending/issue-2421-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/ext/pending/issue-4505-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/issue-3617-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-invoice-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-invoice-examples.txt%20%7D%7D</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-music-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-sponsor-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-sponsor-examples.txt%20%7D%7D</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-tv-listing-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-tv-listing-examples.txt%20%7D%7D</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/1525</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/1688</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/1698</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2288</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2289</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2421</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2543</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2858</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2915</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/3230</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/3475</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/3537</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/3563</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/3617</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/383</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/4603</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues?q=is%3Aissue+is%3Aopen+Organization</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://pending.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/Organization</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/address</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/contactPoint</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/description</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/email</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/faxNumber</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/globalLocationNumber</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/organizationFormationDate</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/organizationLegalName</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/organizationTerminationDate</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/owns</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/parentOrganization</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/subOrganization</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/telephone</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/Organization</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/collab/FIBO</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/collab/GLEIF</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/collab/GoodRelationsTerms</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/collab/TP</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/styleguide.html</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/terms.html</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/duns</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/duns)</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/globalLocationNumber</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/globalLocationNumber)</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/leiCode</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/leiCode)</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/taxID</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/taxID),</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/vatID</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/vatID)</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/BE/LegalEntities/LegalPersons/hasLegalEntityIdentifier</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/BE/OwnershipAndControl/CorporateControl/hasSubsidiary</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/FND/Arrangements/Documents/isReferencedIn</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/FND/Organizations/Organizations/Organization</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/FND/Organizations/Organizations/hasContactPoint</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/FND/Organizations/Organizations/hasMember</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/FND/Parties/Parties/hasTaxIdentifier</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/FND/Places/Addresses/hasRegisteredAddress</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/FND/ProductsAndServices/ProductsAndServices/hasServiceArea</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/FND/ProductsAndServices/ProductsAndServices/offers</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/FND/Relations/Relations/hasDesignation</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/FND/Relations/Relations/hasLegalName</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://validator.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.gleif.org/ontology/L1/hasLEI</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.gs1.org/standards/gs1-digital-link</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Classifiers/isClassifiedBy</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Identifiers/identifiedBy</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Locations/hasAddress</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Locations/isLocatedIn</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Text/hasName</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.w3.org/2003/01/geo/wgs84_pos#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>ajax.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>attic.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>brickschema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>en.wikipedia.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ogp.me</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>pending.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>purl.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rdfs.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ref.gs1.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>spec.edmcouncil.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>tools.ietf.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>unece.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>usefulinc.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>validator.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.gleif.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.gs1.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.omg.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.opengis.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.w3.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>xmlns.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>secretariat@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.111.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>207.241.225.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.108.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>78.153.210.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.16.45.99</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>193.17.90.130</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.15.59.224</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>75.2.60.5</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>217.154.231.107</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>52.73.243.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.26.3.27</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.20.26.191</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.121.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>634b309b4f98a394a1e1b4c81ed6748baf6561ed16b6c96b22085dff1ccfca65</SHA-256>
              <SHA-1>709d7f5f5014a43d423c64ac53fb905817c59620</SHA-1>
              <MD5>d79bf9d5ea0ff77d6e16670a244c3141</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>413d294fad14524bf94e764b33ff0f327682549408545171fcf9240189c154ae</SHA-256>
              <SHA-1>f30daebcb81f94af5e6dfd9e70585b8904d72ac1</SHA-1>
              <MD5>7f44c7691673d77d8557d4d5699ef23a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>26df054d-78cf-4d83-9bb1-a41816125528</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4d5447d7-c61c-4120-ba1b-d7f471d385b9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>ba550d0e-adac-4864-b88b-407cab5e76af</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>fd1aa4f2-ba26-3a05-b72d-4392c35a073c</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxp://schema.org/Organization</name>
        <report_id>2b9ed429-0133-477d-8e44-3b858e7a50b5</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>76ac4090eb794b6550999841f9459f7c4ee0c22b053c311f0bc5c3c3909d725d</id>
    <title>Analysis Report for 76ac4090eb794b6550999841f9459f7c4ee0c22b053c311f0bc5c3c3909d725d</title>
    <updated>2026-08-20T21:45:58Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8775d649c2438a47b72ac2</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8775935a70bef4cd151bb8</flow_id>
        <hash>76ac4090eb794b6550999841f9459f7c4ee0c22b053c311f0bc5c3c3909d725d</hash>
        <iocs>
          <urls>
            <value>
              <url>http://purl.org/dc/dcam/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/dcmitype/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/elements/1.1/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/linked-data/cube#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/vocab/vann/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://rdfs.org/ns/void#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://usefulinc.com/ns/doap#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.opengis.net/ont/geosparql#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.w3.org/1999/02/22-rdf-syntax-ns#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2000/01/rdf-schema#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2001/XMLSchema#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2002/07/owl#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2004/02/skos/core#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2006/time#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/csvw#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/dcat#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/dx/prof/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/odrl/2/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/org#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/prov#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/shacl#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/sosa/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/ssn/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://xmlns.com/foaf/0.1/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://brickschema.org/schema/Brick#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues?q=is%3Aissue+is%3Aopen+EventScheduled</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://schema.org/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/EventScheduled</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://validator.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.w3.org/2003/01/geo/wgs84_pos#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/EventScheduled</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://clients1.google.com/generate_204</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cse.google.com/adsense/search/async-ads.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://cse.google.com/cse.js?cx=013516846811604855281:nj5laplixaa</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&amp;tid=afs&amp;tv=1234567890&amp;st=env&amp;sjk=GizPPQ58TwOFAHL9vi4b+w==&amp;sde=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&amp;v=255&amp;t=2&amp;li=afs_1234567890&amp;jk=GizPPQ58TwOFAHL9vi4b%2Bw%3D%3D&amp;bg=!iIuli-nNAAYssmaFDLI7AEcBe5WfOH3NXaw_iMtytwvAFQMVj0C-U76mcK1TUj3DAM3fTWTf4sXUFG73BcY9iy5imdjWh5RpRB94Oz5JidBCtFjASwolFgIAAAA6UgAAAARoAQd-ABvtDO24FEvOeJTraGbqDM3dyurwGAKUtVyrmC0KAbIwbMUCSJrXavArcLfJU6RmqaizhOL8TVqN47CNxkDhF0GrHjKf0nYvsjGLUI5v4BIae9gtC1JD0NZD0WY91QaSFUtnoJU0GKFktIHckupQAsWiQXuXH4OiLLvPlBk9Jhem-A4L5KRHfvXCaqqjvC26_jbPELQbi7JnYug6jQfLGdvDOc4hAba9Uc1kY8OSAzTgkOu4WtSaMpY7flKhXQGr59M-sK7cXb-uPmrEXQS9xnfiVvlcuEAqnI3zk1vmxaJoZEa8yf5Dbg3JWUkEDhWT-ShZ9DHurHRwtwVtN-L05XNbk-84rMmbxzBV1i78-9pT2OJ42BOy5amMl_1CLb16wE3gt4ROfrIr-aQSQkzAQwnLN4yew1VMImwlMZ4ChmzpOfGBJmSHLIS1uJAdsn_tQWEL0iEHx3JJz4USyhxrqlCLQsfkolQk75Wt3Pe3Crw_h4Gq1TJlGc3miVz7lImb54tZZvqcNDApWJ7pFRugiexWh9hp74DlCYH6TDSQv8uzk0-OtNMFdKzRlFHCWysKtjYaxVAwwIST4yhh4ECO1MqUpGwwwwPQK7Fa7PKK3Iz385kBrEBlvFcsrZPXz4aLUs33218U-LmLrgZj1ATbnC4wyb1KymbYPxy17szEWcMkugyS7oHlgDvyh3nG5AO5W-15DsDhNUenF7ErFAJNIhJAzfx18PNgueJcJvjcp5qfjtzGi7wZ5VvBmFrnJ8WxkQTJLvgwvjHAa-JAZwb6eYu_xvvd1FHc4WYqLRN7KvQAJTADxbFTw4iSsChLa-E6j6jUdSedzBHlDdJq8OlgJUfvxbWw6eNQrr99TwvpXUlJpUfeDjnkaI8gPNl9YqQtPQwmFkCl9txsWHaFqUd54P8x3ws7WE9Ls8bQI9YHANaBYh6sAfYaJXhME_mW24A51vRFOgygMbHXRYq9g6SCmNeEmHj8pVcC32BhBZKc0qjyyx6pmxratdRDKUnFFo8ha0nNsa6Cw1dpWc9oJ091a1aaXYk-N7V2jfoCAN2QjaRFgVfOX5IfBsWKTbtWgYyefy18WeB68jNG6bpd0cShx--8PGhVKqkejv_6hv3aEEJ2pvrOgpBZe9HnQaaeXf3RDHSvNNN3kYCJu-XXbw1dbbq2MqW_JlcWxJbcjO-monRV</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ep2.adtrafficquality.google/sodar/sodar2.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ep2.adtrafficquality.google/sodar/sodar2/255/runner.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Manrope:wght@200..800&amp;family=Noto+Sans+Mono:wght@500..700&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/notosansmono/v37/BngcUXNETWXI6LwhGYvaxZikqZqK6fBq6kPvUce2oAZ2evCj.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues?q=is%3Aissue+is%3Aopen+EventScheduled</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect?v=2&amp;tid=G-7GQQMC8QW5&amp;gtm=45je68j0v9123064558za20g&amp;_p=1787262392597&amp;gcd=13l3l3l2l2l1&amp;npa=0&amp;dma_cps=a&amp;dma=1&amp;_eu=EBAI&amp;are=1&amp;cid=2145613032.1787262393&amp;frm=0&amp;ir=1&amp;ngs=1&amp;pscdl=noapi&amp;rcb=15&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;_s=1&amp;tag_exp=115938466~115938469~118897920~118897930~119367802~119367810~120315471~120385423&amp;dl=https%3A%2F%2Fschema.org%2FEventScheduled&amp;dt=EventScheduled%20-%20Schema.org%20Enumeration%20Member&amp;sid=1787262392&amp;sct=1&amp;seg=0&amp;en=page_view&amp;_fv=1&amp;_ss=1&amp;_ee=1&amp;tfd=386</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/EventScheduled</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/clipboard/clipboard.min.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/devnote.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/favicon.ico</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/prettify.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/prettify.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/pretty-markup/layout.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/pretty-markup/schemarama-parsing.bundle.min.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/pretty-markup/style.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/schemaorg.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/schemaorg.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/sdotermpage.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/sdotermpage.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://validator.schema.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google-analytics.com/analytics.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect?v=1&amp;_v=j102&amp;a=1601197307&amp;t=pageview&amp;_s=1&amp;dl=https%3A%2F%2Fschema.org%2FEventScheduled&amp;ul=en-us&amp;dt=EventScheduled%20-%20Schema.org%20Enumeration%20Member&amp;sr=800x600&amp;vp=1920x1080&amp;_u=IEBAAEABAAAAACAAI~&amp;jid=297287918&amp;gjid=1595204439&amp;cid=2145613032.1787262393&amp;tid=UA-52672119-1&amp;_gid=1544711489.1787262393&amp;_r=1&amp;_slc=1&amp;z=2115764389</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/css/v2/clear.png</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/element/93e57cb47c499c53/cse_element__en.js?usqp=CAM%3D</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/element/93e57cb47c499c53/default_v6+en.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/images/1x/en/branding.png</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/style/look/v6/espresso.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-7GQQMC8QW5&amp;cx=c&amp;_slc=1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>Schema.org</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/EventScheduled&amp;dt=EventScheduled</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/EventScheduled&amp;ul=en-us&amp;dt=EventScheduled</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>ajax.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>brickschema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>purl.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rdfs.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>usefulinc.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>validator.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.opengis.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.w3.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>xmlns.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ajax.googleapis.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>clients1.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cse.google.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>ep1.adtrafficquality.google</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ep2.adtrafficquality.google</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>region1.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>validator.schema.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.18.23.19</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>78.153.210.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>75.2.60.5</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>217.154.231.107</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>207.241.225.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.100</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.250.154.101</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.132</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.13.113</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.153.119</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.100</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.157</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>216.239.32.36</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>185.199.108.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.121.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>216.239.38.21</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>634b309b4f98a394a1e1b4c81ed6748baf6561ed16b6c96b22085dff1ccfca65</SHA-256>
              <SHA-1>709d7f5f5014a43d423c64ac53fb905817c59620</SHA-1>
              <MD5>d79bf9d5ea0ff77d6e16670a244c3141</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>413d294fad14524bf94e764b33ff0f327682549408545171fcf9240189c154ae</SHA-256>
              <SHA-1>f30daebcb81f94af5e6dfd9e70585b8904d72ac1</SHA-1>
              <MD5>7f44c7691673d77d8557d4d5699ef23a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>060e75ef8ea6b278806f416baecb2c5954fd565b0178b1a57ad48992392f11cb</SHA-256>
              <SHA-1>2563a9208460261c0bdeb1b3bffa1fa788da0723</SHA-1>
              <MD5>282dd48b9550dc97a055cff73a7006d2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>ac0ee7a1f393dcd91e3063f75e977d785dd8fb07684ad0042cf5dd5ded14497a</SHA-256>
              <SHA-1>b8dc44d886b5353953bc868f47bf1b03147fde56</SHA-1>
              <MD5>680d65b279cb55d86f292ab6ecd31124</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>9f12d6ef4a44483d254f81e22b43f8965de3a21249c14cedfdeaf0007670c2d4</SHA-256>
              <SHA-1>2c6dbb12cfe9eb684d46f403a4fdcbabaf215a04</SHA-1>
              <MD5>a62e6a9d3dd3f80c7ced572ac0dacaa7</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>da755972e26d0f8b704ec8599c5b407176d35e7e2de3b30f30a080b61723c555</SHA-256>
              <SHA-1>3efe20799648e73638f228940d4f80f2b706695a</SHA-1>
              <MD5>3d92a830ebcfb5664ff6f4ef7f647a08</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxp://schema.org/EventScheduled</name>
        <report_id>dcfacefe-ee8c-4c0d-88f6-156b72f2a62f</report_id>
        <tags>
          <value>html</value>
          <value>txt</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9fc7f9664ea5b85d6c5344b607d9e509a9021b4d32197db36179837e8d85fa77</id>
    <title>Analysis Report for 9fc7f9664ea5b85d6c5344b607d9e509a9021b4d32197db36179837e8d85fa77</title>
    <updated>2026-08-20T21:45:58Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8775d149c2438a47b72ac0</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877593009ae7a1a8d2dee4</flow_id>
        <hash>9fc7f9664ea5b85d6c5344b607d9e509a9021b4d32197db36179837e8d85fa77</hash>
        <iocs>
          <urls>
            <value>
              <url>https://schema.org/RsvpAttendance/Yes</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/favicon.ico</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/RsvpAttendance/Yes</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>schema.org</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.250.154.139</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxp://schema.org/RsvpAttendance/Yes</name>
        <report_id>bc087be4-fea2-4839-8008-0c66cde2e19c</report_id>
        <tags>
          <value>html</value>
          <value>aidetect</value>
          <value>phishing</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e9a625d611e8645a2d1b708d59fb8578a9ebfcc4e6a30c8e74b3959968adaecb</id>
    <title>Analysis Report for e9a625d611e8645a2d1b708d59fb8578a9ebfcc4e6a30c8e74b3959968adaecb</title>
    <updated>2026-08-20T21:45:57Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87767c49c2438a47b72af3</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877593099a97c449ef4aea</flow_id>
        <hash>e9a625d611e8645a2d1b708d59fb8578a9ebfcc4e6a30c8e74b3959968adaecb</hash>
        <iocs>
          <urls>
            <value>
              <url>https://support.google.com/calendar?hl=de</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.google.com/appsstatus#v=status&amp;hl=de</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://calendar.google.com/calendar/event?action=RESPOND&amp;amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;amp;rst=1&amp;amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;amp;ctz=America/Los_Angeles&amp;amp;hl=en&amp;amp;es=0</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>support.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.14.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.150.119</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>95088c15f1af643c0f7d3a526522d3fa555fdce9948e6b32275ad3b0a9f8a662</SHA-256>
              <SHA-1>7f47866098554eb8be6cb6b3147fb2ff42cc3ee7</SHA-1>
              <MD5>7ce0413c06fb722fab18584496d61fbc</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>3fd406533323777bc5a4e0dc2f85b0f752b51e046ebfc926b227fdcfc19cb9f4</SHA-256>
              <SHA-1>b47f44d00057503ce282f06e7277aecb85ab3f89</SHA-1>
              <MD5>aa8a0b9bc6822ec6d763bda347c5eb1e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://calendar.google.com/calendar/event?action=RESPOND&amp;amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;amp;rst=1&amp;amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;amp;ctz=America/Los_Angeles&amp;amp;hl=en&amp;amp;es=0</name>
        <report_id>d1bdbcbe-d1b5-4dcd-a0da-42e2b1a05672</report_id>
        <tags>
          <value>html</value>
          <value>obfuscated</value>
          <value>captcha</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ecea346c1a2e79ccdcd09219254db816794cff0e21c50558a37a56042df2a094</id>
    <title>Analysis Report for ecea346c1a2e79ccdcd09219254db816794cff0e21c50558a37a56042df2a094</title>
    <updated>2026-08-20T21:45:57Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87764cf2677ae4d366d683</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8775921d88974f46c408de</flow_id>
        <hash>ecea346c1a2e79ccdcd09219254db816794cff0e21c50558a37a56042df2a094</hash>
        <iocs>
          <urls>
            <value>
              <url>com.google.android</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>http://support.google.com/a/users/answer/9282720&amp;ec=GAZAdQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.w3.org/1998/Math/MathML</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/1999/xhtml</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/1999/xlink</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2000/svg</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/XML/1998/namespace</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/AccountChooser</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?hl=en&amp;passive=true&amp;continue=http://support.google.com/a/users/answer/9282720&amp;ec=GAZAdQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ads.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://apis.google.com/js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://apps.apple.com/us/app/google-meet/id1096918571</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://content-googleapis-staging.sandbox.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://content-googleapis-test.sandbox.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Google+Sans+Text:wght@400;500;700&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Noto+Color+Emoji&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://google.qwiklabs.com/course_templates/198</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://guidebooks.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/ogw/default-user=s83</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://meet.google.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://moltron-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://myaccount.google.com/privacypolicy?hl=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ogads-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ogs.google.com/widget/app/so?eom=1%5Cu0026awwd=1%5Cu0026em=2%5Cu0026scv=1%5Cu0026dpi=72366329</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ogs.google.com/widget/callout?eom=1%5Cu0026dc=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://play.google.com/log?format=json&amp;hasfast=true</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://play.google.com/store/apps/details</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://play.google.com/store/apps/details?id=com.google.android.apps.tachyon</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://policies.google.com/terms</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://policies.google.com/terms/generative-ai</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://policies.google.com/terms?hl=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://support.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/a/users/answer/9282720</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://support.google.com/a/users/answer/9282720?hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/communities/answer/7424249</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/communities/answer/7425194</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/embed/ads/chat/install</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/embed/ads/chat/install?</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/embed/tagging/install</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/google-ads/marketing-advisor</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/google-ads/workflow/14159772</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/google-ads/workflow/14159772https://support.google.com/google-ads/workflow/14282534https://support.google.com/google-ads/workflow/15498105</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/google-ads/workflow/14282534</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/google-ads/workflow/15498105</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/helpguide/answer/16341349</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://supporttagging-autopush.sandbox.google.com/embed/tagging/install</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://tagassistant.google.com/extension_install</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://workspace.google.com/business/signup/welcome?utm_source=gwslearningcenter&amp;utm_medium=support&amp;utm_campaign=9282720</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.google-analytics.com/analytics.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/accounts/TOS</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/recaptcha/api.js?trustedtypes=true&amp;onload=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/recaptcha/api.js?trustedtypes=true&amp;onload=&amp;render=explicit&amp;hl=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/recaptcha/api.js?trustedtypes=true&amp;render=explicit&amp;onload=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/tools/feedback</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.de/intl/en/about/products?tab=uh</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.googleapis.com/youtube/v3</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.googleapis.com/youtube/v3/videos?part=snippet%2C+id&amp;key=AIzaSyD-4tE5aKFZYIS_IrfpCDRsgQZbv5VCJZM&amp;id=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-H30R9PNQFN</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/og/_/js/k=og.qtm.en_US.1XWJXUlYvhk.2019.O/rt=j/m=q_dnp,q_sf_gm3,q_pc,qmd,qcwid,qapid,qads/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvi59RQ6u6bH649CP9TyvyZ-AZE1Q</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/og/_/ss/k=og.qtm.8iibR_VTNAo.L.W.O/m=q_sf_gm3,qmd,qcwid,d_b_gm3,d_wi_gm3,d_lo_gm3/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTvhavHc_5TUTFiGUMBQhET_neaHtQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/uservoice/feedback/client/web/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/uservoice/feedback/client/web//main_binary__.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/uservoice/feedback/client/web//main_light_binary.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/embed/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://support.google.com/a/users/answer/9282720</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>accounts.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ads.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>apis.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>apps.apple.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>content-googleapis-staging.sandbox.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>content-googleapis-test.sandbox.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>google-analytics.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>google.qwiklabs.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>guidebooks.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>lh3.googleusercontent.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>meet.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>moltron-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>myaccount.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ogads-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ogs.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>play.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>policies.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>support.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>supporttagging-autopush.sandbox.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>tagassistant.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>workspace.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.de</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.gstatic.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.w3.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>192.178.183.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>35.201.118.42</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.81</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.84</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.147</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.132</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.219.138.33</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>5edada587ffbb52c5c071c2f528ee46b4be6bcdf5a66723d2d948a4f5b4691f1</SHA-256>
              <SHA-1>bf83b620f7d75705ad6d33e6604f1faa52b0f734</SHA-1>
              <MD5>97e8e40271d2664d78df9700a7acdf80</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>31b287562bd20aa6687ff64da94cfbaa764c0f3d0a174f1378beac2c9a101157</SHA-256>
              <SHA-1>9658954bb64ce42e72fcfed9692de59e65c61c94</SHA-1>
              <MD5>3250f191da6dccdec927debaf62fed75</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>9ef530856955d0672ad58423fc9a0c6dbcd14a2253eb61c3bba70f47677d39aa</SHA-256>
              <SHA-1>4ad3007ec523b79667e873bfb79e568ebb05ba6c</SHA-1>
              <MD5>b0ada3799dc43b378c535454fcfc23ce</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>f3d96919f6342983ae9c8641f13bd9c67979a060e3da397a4fc76895b4b4a6e9</SHA-256>
              <SHA-1>946ab26a2df6ac16fd3cc6748722ff509f8b46e4</SHA-1>
              <MD5>ce41879f1677c0592b0263d672d5ff3c</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>758cd5d0e75d09da4888eb33dedd66decdecb3ef36533f15b56002bb905ea652</SHA-256>
              <SHA-1>dd0fa1f63fa7a38d2cfcd376a78723cb1ddf4335</SHA-1>
              <MD5>836c3b93a38058b660c942796d94faf2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>a8e07c7c6e765548b94462b5b08337da845dfb871786d23c8dc7f8ff56d1b5d6</SHA-256>
              <SHA-1>5c5c01e66ed036813c85e1d4c65d8c036ac810cb</SHA-1>
              <MD5>a79e039d11ffb68480cf30c280034413</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>c8d946640ea7bda16e288277a8dca7929010346e498cfab705b3d99587ddf643</SHA-256>
              <SHA-1>452196863aa71943b644fc551c8fd71b22144165</SHA-1>
              <MD5>dd574c054e4c4e3b8a80c78f18f60341</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1d4ea0d7-372d-4c08-96ce-f9283c54579f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://support.google.com/a/users/answer/9282720</name>
        <report_id>d5c4b9a7-f0a1-467c-b13b-60645fea9cae</report_id>
        <tags>
          <value>html</value>
          <value>base64</value>
          <value>obfuscated</value>
          <value>captcha</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>12d3bafd87d5c394035f87ccc10e7ea1c7ef2bb59812fdae8d5fcee24357ed6f</id>
    <title>Analysis Report for 12d3bafd87d5c394035f87ccc10e7ea1c7ef2bb59812fdae8d5fcee24357ed6f</title>
    <updated>2026-08-20T21:45:57Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877647f2677ae4d366d681</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8775920dfb99c1ceb09954</flow_id>
        <hash>12d3bafd87d5c394035f87ccc10e7ea1c7ef2bb59812fdae8d5fcee24357ed6f</hash>
        <iocs>
          <urls>
            <value>
              <url>https://meet.google.com/meb-jyvf-qsy&amp;apn=com.google.android.apps.tachyon&amp;isi=1096918571&amp;ibi=com.google.Tachyon&amp;cid=6046635465876575538</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://meet.app.goo.gl/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://meet.app.goo.gl/?link=https://meet.google.com/meb-jyvf-qsy&amp;apn=com.google.android.apps.tachyon&amp;isi=1096918571&amp;ibi=com.google.Tachyon&amp;cid=6046635465876575538</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://meet.google.com/meb-jyvf-qsy</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>meet.app.goo.gl</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.13.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>21aeee8fedab0bb57c61cb8fd4ecae70d2f073b2f76f1b9aa59a39f3a2e81258</SHA-256>
              <SHA-1>4fe30884c6364efeb91c4047efb585df57c1ebdf</SHA-1>
              <MD5>a974c252efb5e3ef4ec05d66a1c983da</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>76f9fd359b09309752acc46cacfda68ab0fb904654640235d13d82aa7b930d9a</SHA-256>
              <SHA-1>7823ddda65e4f2184f0726774bfa94706aa41103</SHA-1>
              <MD5>5db9e8be6597824560532d4b16e1f132</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>c2aee92c5b5bd398f3aac30417227ac4fe612ba073e95ee36901906cb8dae40e</SHA-256>
              <SHA-1>9e22a1fa0f637c49b902ec70c78c4e4ecc96da09</SHA-1>
              <MD5>be7604d6b1ce3a61e030965a9fc1ad7b</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://meet.google.com/meb-jyvf-qsy</name>
        <report_id>ad678001-30b1-4346-9e1c-74659c5fbb80</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>51a1bd549e9077f1f81d3e962c21b813429448c7ee7267e9f562e921be50fa74</id>
    <title>Analysis Report for 51a1bd549e9077f1f81d3e962c21b813429448c7ee7267e9f562e921be50fa74</title>
    <updated>2026-08-20T21:45:57Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8775ce49c2438a47b72abe</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877593099a97c449ef4aeb</flow_id>
        <hash>51a1bd549e9077f1f81d3e962c21b813429448c7ee7267e9f562e921be50fa74</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schema.org/Person</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://rnews.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://schema.org/Person#eg-0001</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/Person#eg-0189</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/Person#eg-0206</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/Person#eg-0212</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/Person#eg-0249</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/Person#eg-0250</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/Person#eg-0276</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/Person#eg-0295</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/Person#eg-0374</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/Person#eg-0375</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/Person#eg-0376</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/Person#eg-0388</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/Person#eg-0427</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/Person#eg-0428</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://schema.org/Person#eg-0454</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://tools.ietf.org/html/bcp47</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.gs1.org/gln</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://clients1.google.com/generate_204</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cse.google.com/adsense/search/async-ads.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://cse.google.com/cse.js?cx=013516846811604855281:nj5laplixaa</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/Call_sign</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/JSON-LD</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/Microdata_(HTML)</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/RDFa</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&amp;tid=afs&amp;tv=1234567890&amp;st=env&amp;sjk=rEcPnA3mRkCgEPdRcp12vw==&amp;sde=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&amp;v=255&amp;t=2&amp;li=afs_1234567890&amp;jk=rEcPnA3mRkCgEPdRcp12vw%3D%3D&amp;bg=!Q0ClQCLNAAYssmaFDLI7AEcBe5WfOLEFGMqRLk3P5wCJVSIyHMLcQcN5NIKq27-QKRcFitVn1yNjM-UcVZSkdG5sfR8d1dQ5tw-OAHVj1o3Qny7LfzWtxwIAAAAzUgAAAAVoAQd-ABst-z4ncN6_ie2WzGtjPJlgW7F3DtHt4cEfVrYKAbLyKYgLXLYbtyGeU3lBmrMwJSvd3bOwXTyhSH9i8CSpzxnUS-40Ms7h6ZpToOe1Vq5AZa8B2oWg-joEz4pNPlk2PzXzo4eAjCyq-yMc3mVlmKZvjsmsTC-cc01QRTjZ8vsVZ10yjxIaPcWZrNcpqwt3iNyxrluMTHEoXI4S1kEKzmciD97ddS4L23dLZfpLFpRVDdKpubHbsxKJ-aNHT9aAY205EKVFHvNpySlewlJKkc6Ew9r8CaZ1583Gtq4nQGFjwL8ad1IhRtWvb3VMC5sAA_0JDqM5Nsp9W7yFd05drmsaM5Ts5z2nrjlHhjOy6IuMTVeKIztGqOLAjZGqYGz9kJuFFdz0ptnS2guY6UZYWLmd8OhfPZ8p9y6Mo4xVXjGIkTFiW3Bj9jqbE2OmfcSUiQKn28ixkrVBwD2050erfoGSEe-pFxIH3MXLZEovkdWA0EG9RpzV_S0LpnnZhY2jI-mU0Gc958_VCNGttEmmwDinSG4i1e73PjOsqr09f818VacjxRzFIxJBBZg82GtNn2TDC8NofriD1fUlsP2ksZr7J1Xmd6u3D0QO9UcO277Jf5kBn013WC9k1ZFcoJy5CBQt-6SqFCFDcsS7PFAbAdvLrtvfLM2GZX9lWIXsA2c12ZvRqO0IbaVnFxMQmKqz5J8aTPoOqMh7LRyMSqNNainC3Wbxf7NBLKGNy1fWtXzYTBHemnLnIna6hTY9s6IQbCXMSH_J_AWjFmRn8P0AYkGEOMW7_AkC8HC4nwvdsodr7c4BMQTGFsK2NQpp-r37JCgu4jgJrg0TKlD09qjgdis-lCxTtjp62XNtvacKOjgAYY7dr9oe3T96luT3FAFz54_jV4j8SfzBtSyqI3hBRLrjPGopIPLyMKfN2g-dEZtDIyvt8yO_N3XAIR05mYutxfPbhhSL8eJOnmktITLdUQZ5uAwAOat869w9-x_wHFiFlrxSBiOS-ILnTz2YRs27w7W4ozMzIiJWnaUoHWoYo9ZOC4AYHmmrfYC6RKyPULp60SY2TWZRHTHUYvpxzQIbqUrsvltYnGdtdFgEjsENs6W4SBtmPyuYKdwo16IjDIN9EqHA_Cpy_DTNN4LEs6Cq4RwK_u1pxvJMeabmbXXAmGJ07og</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ep2.adtrafficquality.google/sodar/sodar2.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ep2.adtrafficquality.google/sodar/sodar2/255/runner.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Manrope:wght@200..800&amp;family=Noto+Sans+Mono:wght@500..700&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/notosansmono/v37/BngcUXNETWXI6LwhGYvaxZikqZqK6fBq6kPvUce2oAZ2evCj.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues?q=is%3Aissue+is%3Aopen+Person</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect?v=2&amp;tid=G-7GQQMC8QW5&amp;gtm=45je68j0h1v9123064558za20g&amp;_p=1787262360106&amp;gcd=13l3l3l2l2l1&amp;npa=0&amp;dma_cps=a&amp;dma=1&amp;_eu=EBAI&amp;are=1&amp;cid=1999154015.1787262360&amp;frm=0&amp;ir=1&amp;ngs=1&amp;pscdl=noapi&amp;rcb=18&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;_s=1&amp;tag_exp=115938466~115938469~118897920~118897930~119367802~119367810~120315470~120385423~120412528&amp;dl=https%3A%2F%2Fschema.org%2FPerson&amp;dt=Person%20-%20Schema.org%20Type&amp;sid=1787262360&amp;sct=1&amp;seg=0&amp;en=page_view&amp;_fv=1&amp;_ss=1&amp;_ee=1&amp;tfd=530</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/Person</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/clipboard/clipboard.min.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/clipboard/clippy.svg</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/devnote.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/favicon.ico</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/prettify.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/prettify.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/pretty-markup/layout.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/pretty-markup/schemarama-parsing.bundle.min.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/pretty-markup/style.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/schemaorg.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/schemaorg.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/sdotermpage.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/sdotermpage.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/styleguide.html</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://validator.schema.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google-analytics.com/analytics.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect?v=1&amp;_v=j102&amp;a=1400049521&amp;t=pageview&amp;_s=1&amp;dl=https%3A%2F%2Fschema.org%2FPerson&amp;ul=en-us&amp;dt=Person%20-%20Schema.org%20Type&amp;sr=800x600&amp;vp=1905x1080&amp;_u=IEBAAEABAAAAACAAI~&amp;jid=1523929587&amp;gjid=25692661&amp;cid=1999154015.1787262360&amp;tid=UA-52672119-1&amp;_gid=2067871026.1787262360&amp;_r=1&amp;_slc=1&amp;z=1305255545</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/css/v2/clear.png</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/element/93e57cb47c499c53/cse_element__en.js?usqp=CAM%3D</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/element/93e57cb47c499c53/default_v6+en.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/images/1x/en/branding.png</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/cse/static/style/look/v6/espresso.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-7GQQMC8QW5&amp;cx=c&amp;_slc=1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>Schema.org</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/Person&amp;dt=Person</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/Person&amp;ul=en-us&amp;dt=Person</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#description</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#image</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#title</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ogp.me/ns#url</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/dcam/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/dcmitype/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/elements/1.1/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/terms/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/linked-data/cube#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://purl.org/vocab/vann/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://rdfs.org/ns/void#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://rnews.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://tools.ietf.org/html/bcp47</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://tools.ietf.org/html/bcp47).</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://unece.org/vocab#ApplicableCertificate</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://unece.org/vocab#brandName</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://unece.org/vocab#dUNSId</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://unece.org/vocab#gLNId</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://usefulinc.com/ns/doap#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.gs1.org/gln</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://www.gs1.org/gln)</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.opengis.net/ont/geosparql#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.w3.org/1999/02/22-rdf-syntax-ns#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2000/01/rdf-schema#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2001/XMLSchema#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2002/07/owl#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2004/02/skos/core#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/2006/time#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/csvw#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/dcat#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/dx/prof/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/odrl/2/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/org#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/prov#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/shacl#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/sosa/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.w3.org/ns/ssn/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://xmlns.com/foaf/0.1/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://brickschema.org/schema/Brick#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/Call_sign</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/Call_sign),</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/JSON-LD</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/Microdata_(HTML)</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/RDFa</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/examples.txt%20%7D%7D</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/ext/pending/issue-1698-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/ext/pending/issue-2192-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/ext/pending/issue-2421-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-invoice-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-invoice-examples.txt%20%7D%7D</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-music-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-sponsor-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-sponsor-examples.txt%20%7D%7D</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-visualartwork-examples.txt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/blob/main/data/sdo-visualartwork-examples.txt%20%7D%7D</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/1670</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/1688</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/1698</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2109</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2192</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2289</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2322</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2341</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2421</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2858</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/2935</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/3230</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/3617</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/383</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/4540</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues/4603</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://github.com/schemaorg/schemaorg/issues?q=is%3Aissue+is%3Aopen+Person</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://pending.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/address</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/contactPoint</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/description</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/email</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/faxNumber</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/globalLocationNumber</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/owns</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ref.gs1.org/voc/telephone</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://schema.org/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/Female</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/Male</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/Person</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://schema.org/docs/collab/GoodRelationsTerms</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/collab/TP</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/collab/rNews</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/docs/styleguide.html</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://schema.org/docs/terms.html</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/FND/Arrangements/Documents/isReferencedIn</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/FND/Organizations/Organizations/hasContactPoint</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/FND/Parties/Parties/hasTaxIdentifier</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/FND/ProductsAndServices/ProductsAndServices/offers</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://spec.edmcouncil.org/fibo/ontology/FND/Relations/Relations/hasDesignation</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://validator.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Classifiers/isClassifiedBy</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Identifiers/identifiedBy</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.omg.org/spec/Commons/Text/hasName</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.w3.org/2003/01/geo/wgs84_pos#</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>ajax.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>brickschema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>en.wikipedia.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ogp.me</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>pending.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>purl.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rdfs.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ref.gs1.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>rnews.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>spec.edmcouncil.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>tools.ietf.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>unece.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>usefulinc.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>validator.schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.gs1.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.omg.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.opengis.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.w3.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>xmlns.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ajax.googleapis.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>clients1.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cse.google.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>en.wikipedia.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ep1.adtrafficquality.google</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ep2.adtrafficquality.google</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>github.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>region1.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>rnews.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>tools.ietf.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>validator.schema.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.gs1.org</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>jane-doe@illinois.edu</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>jane-doe@xyz.edu</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.111.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.108.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>207.241.225.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>16.15.230.74</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.20.26.191</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>75.2.60.5</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.26.3.27</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>52.73.243.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.100</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.250.154.139</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.132</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.13.100</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.153.119</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.100</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.155</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>216.239.34.36</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.23.19</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.121.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>78.153.210.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.16.45.99</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.15.59.224</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>217.154.231.107</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>634b309b4f98a394a1e1b4c81ed6748baf6561ed16b6c96b22085dff1ccfca65</SHA-256>
              <SHA-1>709d7f5f5014a43d423c64ac53fb905817c59620</SHA-1>
              <MD5>d79bf9d5ea0ff77d6e16670a244c3141</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>413d294fad14524bf94e764b33ff0f327682549408545171fcf9240189c154ae</SHA-256>
              <SHA-1>f30daebcb81f94af5e6dfd9e70585b8904d72ac1</SHA-1>
              <MD5>7f44c7691673d77d8557d4d5699ef23a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>9baa787cbd6f3f3a794bc654ef8cc90c2b6c971cde02d23f69096c5992f0cbda</SHA-256>
              <SHA-1>35598df1bb9f732d6b1321e5e32d17358940722c</SHA-1>
              <MD5>264b68dc4a943dd5b988aab0fa10fac6</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>26df054d-78cf-4d83-9bb1-a41816125528</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4d5447d7-c61c-4120-ba1b-d7f471d385b9</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>ba550d0e-adac-4864-b88b-407cab5e76af</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>fd1aa4f2-ba26-3a05-b72d-4392c35a073c</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxp://schema.org/Person</name>
        <report_id>15324126-c232-418b-af42-e52d6c55203b</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0db5779c01f0c98b9b9c795e29e24ee13c489e52cb7fc4fd64bbbbff9fc9b187</id>
    <title>Analysis Report for 0db5779c01f0c98b9b9c795e29e24ee13c489e52cb7fc4fd64bbbbff9fc9b187</title>
    <updated>2026-08-20T21:45:57Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87763af2677ae4d366d67e</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8775925a70bef4cd151bac</flow_id>
        <hash>0db5779c01f0c98b9b9c795e29e24ee13c489e52cb7fc4fd64bbbbff9fc9b187</hash>
        <iocs>
          <urls>
            <value>
              <url>https://calendar.google.com/calendar/r?eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://meet.google.com/meb-jyvf-qsy</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://tel.meet/meb-jyvf-qsy?pin=9873753615312&amp;hs=0</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.google.com/intl/en/googlecalendar/about.html</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://calendar.google.com/calendar/event?action=RESPOND&amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;rst=2&amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;ctz=America/Los_Angeles&amp;hl=en&amp;es=0</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>calendar.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>meet.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>tel.meet</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>ccorbett@esri.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>riley@bridgeitconsulting.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>142.251.110.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.152.119</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>5f15908a28da514c31a646ef4061a9c8dae9428d7f716325cd8d1ad552fd10fa</SHA-256>
              <SHA-1>d68ccb43df04559b0a3f83b75fe9e31e188e04ae</SHA-1>
              <MD5>62afe609d19ee312ea630174b1c421d8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>dec9102e9ed732ffff827ef28e1754ca9e8aea673d7249db82826fa460486f41</SHA-256>
              <SHA-1>eb9ee0a1e9821f2d5b25b6854144beae14c07aec</SHA-1>
              <MD5>584fcab84a11cd2d774eb30bf3b30bb6</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>5e6c8697b543fe41d569db63b8faf3f955b4c65fbe40725af162057bc63adad3</SHA-256>
              <SHA-1>c12a30f0bad506ba14ddf5b2e15983f533d04260</SHA-1>
              <MD5>14fdb885d1afdc53838e45bb74fe8de2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://calendar.google.com/calendar/event?action=RESPOND&amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;rst=2&amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;ctz=America/Los_Angeles&amp;hl=en&amp;es=0</name>
        <report_id>aac757f7-3124-4df7-a98e-67177cfe33fa</report_id>
        <tags>
          <value>html</value>
          <value>obfuscated</value>
          <value>captcha</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>563083bd0ef6ec3bf0006aeaa820c3683eaf8e26afca41359f6c652f985da739</id>
    <title>Analysis Report for 563083bd0ef6ec3bf0006aeaa820c3683eaf8e26afca41359f6c652f985da739</title>
    <updated>2026-08-20T21:45:57Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877604f2677ae4d366d671</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8775925a70bef4cd151bad</flow_id>
        <hash>563083bd0ef6ec3bf0006aeaa820c3683eaf8e26afca41359f6c652f985da739</hash>
        <iocs>
          <urls>
            <value>
              <url>https://calendar.google.com/calendar/r?eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbQ</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://meet.google.com/meb-jyvf-qsy</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://tel.meet/meb-jyvf-qsy?pin=9873753615312&amp;hs=0</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.google.com/intl/en/googlecalendar/about.html</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://calendar.google.com/calendar/_/web/calendar-static/_/ss/k=calendar-web.eventpage.sAfZ9JUOceA.L.W.O/am=BESFAw/d=0/rs=ABFko38agyV8cMJs3vOKPL8Nilk-nBYsTw</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://calendar.google.com/calendar/event?action=VIEW&amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;ctz=America/Los_Angeles&amp;hl=en&amp;es=0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://calendar.google.com/calendar/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://calendar.google.com/calendar/r?eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbQ</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://calendar.google.com/googlecalendar/images/calendarlogo/calendar_logo_en_41px_1x_r1.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://calendar.google.com/googlecalendar/images/icon_color_no.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://meet.google.com/meb-jyvf-qsy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tel.meet/meb-jyvf-qsy?pin=9873753615312&amp;hs=0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.com/intl/en/googlecalendar/about.html</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://calendar.google.com/calendar/event?action=VIEW&amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;ctz=America/Los_Angeles&amp;hl=en&amp;es=0</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>calendar.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>meet.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>tel.meet</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>calendar.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>meet.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>tel.meet</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>ccorbett@esri.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>riley@bridgeitconsulting.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>142.251.20.139</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.152.119</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>8cf5ff9f3da3f1d61c3712ff18dc5f72f1bb61c88185f6dec9fabddc1c263744</SHA-256>
              <SHA-1>37b53efaab36d96705e972b4ef02d857e598d3e6</SHA-1>
              <MD5>1b286377f351aceca0c4d4fc51e9dc86</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>7ca325344a312b9dbb7caea59115453f340f496a964499dd6c5d9f0c52ca347f</SHA-256>
              <SHA-1>881bcc257fde5952d5b03c36e6c12014d624d996</SHA-1>
              <MD5>0e5ab8a0db3cbada241e11a88b32a4e5</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>1c45e5dff1284100aec1da9c24ebfad49bc313bdbb5ea7f8f27aaa5b93f5f2f8</SHA-256>
              <SHA-1>2a4ff62e4c61234acd827c14f7d768ca4ab37baf</SHA-1>
              <MD5>c3bb7c91c92c05d17f9871011c2ee3ff</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>4dc727dfd6b6805869369e5578d5efa8055a92533911e05f6889aa7327163a12</SHA-256>
              <SHA-1>f0657a376a9cc8a4c95c57fa199ef4dc58cff8ff</SHA-1>
              <MD5>e7e5c433d66a9ac4cc66021d401b57cc</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://calendar.google.com/calendar/event?action=VIEW&amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;ctz=America/Los_Angeles&amp;hl=en&amp;es=0</name>
        <report_id>5fc2bb1b-da40-4095-83be-3f11d8a84c92</report_id>
        <tags>
          <value>html</value>
          <value>obfuscated</value>
          <value>captcha</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>56e752349fc77e8a84a6bdf72720479f0b6816b49e9c7dfacc3da891686bf196</id>
    <title>Analysis Report for 56e752349fc77e8a84a6bdf72720479f0b6816b49e9c7dfacc3da891686bf196</title>
    <updated>2026-08-20T21:45:57Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877620f2677ae4d366d677</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877592009ae7a1a8d2ded2</flow_id>
        <hash>56e752349fc77e8a84a6bdf72720479f0b6816b49e9c7dfacc3da891686bf196</hash>
        <iocs>
          <urls>
            <value>
              <url>https://accounts.google.com/AccountChooser?hl%5Cu003den-US</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/Logout?hl%5Cu003den-US</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin?ltmpl%5Cu003dmeet%5Cu0026osid%5Cu003d1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.google.com/TOS</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/TOS?privacy=true</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://addons-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://addons.gsuite.google.com/client</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://admin.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://appsgrowthpromo-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://client-channel.google.com/client-channel/client</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://client-side-encryption.google.com/meet/init</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://client-side-encryption.google.com/oidc/meet/callback</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://clients4.google.com/invalidation/lcs/client</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://connect.corp.google.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://docs.google.com/picker</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://meet.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://meet.google.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://meet.google.com/tel/meb-jyvf-qsy</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://meet.google.comv1_meetings</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://myaccount.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://myphonenumbers-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://slides-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://slides-pa.clients6.google.comAIzaSyCG_6Rm6c7ucLr2NwAq33-vluCp2VfSkf0v1internal</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://takeout.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://videoconf.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://workspace.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://workspaceui-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.google.com/js/bg/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://tel.meet/meb-jyvf-qsy?pin=9873753615312&amp;hs=0</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>accounts.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>addons-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>addons.gsuite.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>admin.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>appsgrowthpromo-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>client-channel.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>client-side-encryption.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>clients4.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>connect.corp.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>docs.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>meet.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>meet.google.comv1_meetings</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>myaccount.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>myphonenumbers-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>slides-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>slides-pa.clients6.google.comAIzaSyCG_6Rm6c7ucLr2NwAq33-vluCp2VfSkf0v1internal</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>takeout.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>videoconf.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>workspace.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>workspaceui-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>192.178.183.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.84</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.217.112.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.129</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>374dae3b7c4fe0bd05084d263d0593f01eb74790c5e4789f1c86b7abe8b9f95a</SHA-256>
              <SHA-1>b2dc31ca48a716eca8fd09a24f18ce74a5ca048c</SHA-1>
              <MD5>e601fc1ae86aaed297cf8c72601dea90</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>46afaba880331828b58d7dd818dbcd4945d193a26e053b341e59625934561205</SHA-256>
              <SHA-1>ed77986d6d1f32c366ba590c56a8d3849cc962c1</SHA-1>
              <MD5>33e81b75b721a6e5fb343609ca61470f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>b2ca11410177d9e6732f42bda069a9fbbc0c74a396eff0c2ea169dbd376898be</SHA-256>
              <SHA-1>150cad5c8cf7673de25d105f53b86387f176d6ec</SHA-1>
              <MD5>4ea244655721dec80f6e0633b7d0e086</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>524b7fbea63a86423d67ff36839862da94ce92f12adf629ddf56f17d96e6bf42</SHA-256>
              <SHA-1>faa696d58c6cd3ba7ad7d3550bd0a665b88c13b7</SHA-1>
              <MD5>119f70be9268f341e68badfe3863c2c4</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>38b37b82c94a4dd66a09e85aed00be0d0f033358dfe060c0fe2740358781c80a</SHA-256>
              <SHA-1>dbd98df964987b63532937f0d36167d3c20ce9f1</SHA-1>
              <MD5>cd407490d37d2e94a0e932dbb66149d2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>0daa9fda62d7e02ef84690d092d2e53712c3e60dd8fdf50af839acd09d7ebf38</SHA-256>
              <SHA-1>a7018ae26eeefb61be0edad9e3f2657d8bd95873</SHA-1>
              <MD5>9322c5331a934204c51a5e9f70a154af</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>f86f806176e93ab739b0533bace1a52034c9335925957c21fb31365c89777542</SHA-256>
              <SHA-1>7e0dd17fd2b55b6bb65f185a140236c853bd22c4</SHA-1>
              <MD5>ffa0c4731e6ecaeb1a64bad501c5a073</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>x5ebd1:$btc: 13Fv471h9oEHSvvKYMVgpDQuiwB</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x630bd:$btc: 1yrtSTrkxmnAGARs9QBRU4ojEtb</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x665e4:$btc: 3xdGt9wvDyrDQZtbEGwkpJnR9V6nEF5</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x66fe7:$btc: 1dNCMrQYwm8eY3A4VVEdyT5cxfse</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>hxxps://tel.meet/meb-jyvf-qsy?pin=9873753615312&amp;hs=0</name>
        <report_id>27e7727e-565a-4941-9bca-ce72f6c12b94</report_id>
        <tags>
          <value>html</value>
          <value>base64</value>
          <value>obfuscated</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>169fecc629131be9a362f15699d6b989ff26164d55698479107a53858bd19797</id>
    <title>Analysis Report for 169fecc629131be9a362f15699d6b989ff26164d55698479107a53858bd19797</title>
    <updated>2026-08-20T21:45:57Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87763649c2438a47b72ae1</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877593009ae7a1a8d2dee6</flow_id>
        <hash>169fecc629131be9a362f15699d6b989ff26164d55698479107a53858bd19797</hash>
        <iocs>
          <urls>
            <value>
              <url>https://support.google.com/calendar?hl=de</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.google.com/appsstatus#v=status&amp;hl=de</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://calendar.google.com/calendar/event?action=RESPOND&amp;amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;amp;rst=2&amp;amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;amp;ctz=America/Los_Angeles&amp;amp;hl=en&amp;amp;es=0</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>support.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.14.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.152.119</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>8505a70301bde6b71c1e35e931cde2cc8729f71c630174b936ea9dc155098be5</SHA-256>
              <SHA-1>534052e4c348850ec16075951f04ddbaba619486</SHA-1>
              <MD5>6698dda167d834db79632f16032a2f1e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>d705a05d3058bf63f47d755291012d952eb739eb344a11aa362cb27c6a0407b2</SHA-256>
              <SHA-1>24abafd11b2b2469ef5c869f0cc8ff2613fd4fe6</SHA-1>
              <MD5>51c1051de60308a9518db9f61f5f60d9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://calendar.google.com/calendar/event?action=RESPOND&amp;amp;eid=MjdraWVvYzVvcjRjZnJ0OW40OXZtMjR0cW8gY2NvcmJldHRAZXNyaS5jb20&amp;amp;rst=2&amp;amp;tok=MjgjcmlsZXlAYnJpZGdlaXRjb25zdWx0aW5nLmNvbTBhNWRhOWQ4NjFmNTA2ZDJiMzEzNDAzMTFkMDBmNjgwMTJiM2NhMjQ&amp;amp;ctz=America/Los_Angeles&amp;amp;hl=en&amp;amp;es=0</name>
        <report_id>8097230f-4dd7-4d1f-ba56-2b1e198eff20</report_id>
        <tags>
          <value>html</value>
          <value>obfuscated</value>
          <value>captcha</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>16ee741322c7db8477f2ad2b8f6d0f505c132c5b46b4a49d1fbfef6b36b6e6dc</id>
    <title>Analysis Report for 16ee741322c7db8477f2ad2b8f6d0f505c132c5b46b4a49d1fbfef6b36b6e6dc</title>
    <updated>2026-08-20T21:45:56Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87762249c2438a47b72adb</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877593009ae7a1a8d2dee8</flow_id>
        <hash>16ee741322c7db8477f2ad2b8f6d0f505c132c5b46b4a49d1fbfef6b36b6e6dc</hash>
        <iocs>
          <urls>
            <value>
              <url>com.google.android</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>https://calendar.google.com/calendar/r&amp;followup=https://calendar.google.com/calendar/r&amp;osid=1&amp;passive=1209600&amp;service=cl&amp;flowName=GlifWebSignIn&amp;flowEntry=ServiceLogin&amp;ifkv=AQDHYWrL2lk0_Bcr1n1Y-f-i1sNZRKJK8CNisliX9rpozkqKhY2Jby8gsVZ_wDz_oHqiWmN6uZ6s6g</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://about.appsheet.com/home/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://about.google/?hl=en_us</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://account.google.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin/identifier</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://accounts.google.com/ServiceLogin/identifier?dsh=S1611624178:1665765818620318&amp;continue=https://calendar.google.com/calendar/r&amp;followup=https://calendar.google.com/calendar/r&amp;osid=1&amp;passive=1209600&amp;service=cl&amp;flowName=GlifWebSignIn&amp;flowEntry=ServiceLogin&amp;ifkv=AQDHYWrL2lk0_Bcr1n1Y-f-i1sNZRKJK8CNisliX9rpozkqKhY2Jby8gsVZ_wDz_oHqiWmN6uZ6s6g</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ads.google.com/home/?subid=[subid]</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://app-sj24.marketo.com/index.php/leadCapture/save</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://apps.apple.com/us/app/google-calendar-get-organized/id909319292</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://businessmessages.google/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://chromeenterprise.google/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cloud.google.com/?hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cloud.google.com/find-a-partner/?products=Google%20Workspace&amp;hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cloud.google.com/press/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cloud.googleblog.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cloud.withgoogle.com/partners/?products=GOOGLE_WORKSPACE_PRODUCT</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cloudonair.withgoogle.com/gws-events?utm_source=wgc&amp;utm_medium=et&amp;utm_campaign=FY25-gws-global-webinar-program-&amp;utm_content=gws-nav-bar&amp;utm_term=-</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://domains.google.com/about/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://edu.google.com/products/workspace-for-education/education-fundamentals?hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://edu.google.com/workspace-for-education/editions/education-fundamentals/?hl=[lang]</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://en.wikipedia.org/wiki/Google_Workspace</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://families.google/intl/en_us/families/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Google+Sans:400%7CGoogle+Sans+Text:700%7CRoboto:700&amp;subset=latin&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Material+Icons%7CGoogle+Sans:500,700%7CGoogle+Sans+Text:400,500%7CRoboto:400,500&amp;subset=latin&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Material+Icons+Outlined&amp;text=%20_acefghilnoprstuw&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://form-submit-service-dot-gsuite-staging.uc.r.appspot.com/submit</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://goo.gle/3xj0b2F</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/0gV19jeU6cpBMNkDs6u7q08PQ7E5P_0Bf6oibExy2Mz8Emp7qGp-pkWOwWUNlkUToF5BTOFTeifznQJ33UbY92kd-_5zXs3hLDThkA=e365-pa-nu-rw-w1132</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/0gV19jeU6cpBMNkDs6u7q08PQ7E5P_0Bf6oibExy2Mz8Emp7qGp-pkWOwWUNlkUToF5BTOFTeifznQJ33UbY92kd-_5zXs3hLDThkA=e365-pa-nu-rw-w566</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/1LLhMBNOaEpSe2xxbngLDCIxVlli4I35h-b2Tw6-Fp-5OnhEUgqsRPrb-SLriAmDeTz51D1GVQ7RK9JyOEQK1ds9nLry22o4jy0=e365-pa-nu-rw-w1472</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/1PQEGb7H8LP5QwcVh0ORBfwIVMolriE0c2nSilOg5XmBxBAUWXWDbDcBCdRfiJ5LI9VLTDy90_vZzG738g3wzCLiGl5c5Hb1A7Khrw=e365-pa-nu-rw-w528</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/1PQEGb7H8LP5QwcVh0ORBfwIVMolriE0c2nSilOg5XmBxBAUWXWDbDcBCdRfiJ5LI9VLTDy90_vZzG738g3wzCLiGl5c5Hb1A7Khrw=e365-pa-nu-rw-w720</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/3cZXhtFEVwBbgBwwS9gZYzWB-u-W1gTqD_r2v4FaKM6JOGq02JNQ2gebc3LiF1OukuL1pdJk1esJ_JbjOnrAq5vkZp7G2maRor0=e365-pa-nu-rw-w608</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/5tfnmDis3RXANC5r79KDyqzQ4PrunmPiMZ2aK18IUgl95tKRlDS_f5jQBfzLv41kJM3Kge4j2tu0MT7vLygzYiDwW_zg5rXgkh-N=e365-pa-nu-rw-w608</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/7SMvyWoqxRhfcTksjbhO11ucB8fL6jvYwTYFvjtQvnJaUyrqKIhjd9bcrDrtiSdv4acQqFboCmvZ_wsVqZlHxuzmnEfJ2JBN-UUw=e365-pa-nu-rw-w1188</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/GgR_QtGCpnA5hcuf6f6IJ5FsmBnNZfZKknpJg2gIZOVaXw_2ZRkmlViP98ALPmB2J1oGy0TJYXLyS5Y69R815MWrwqb2Pop_r3Y-=e365-pa-nu-rw-w608</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/OXxyvAmVHpAi0Pq0S8kzhCJjAgjd6Z3NOLWB98l2VjTmjGL0AQH1vUTPjEGR-GbmbmvZRG_IMwLbaRUhwE7yyH-HO5rVjRwFH1tK=e365-pa-nu-rw-w1472</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/X7baVHA68M6OJc2KK7VwYS9FR9iNO7y_6MJgshU9q9TznZb43USk2whnh6ftGi9-72LcZRMfQgSWOozYfr1yGe86ILDdvDgdpbwJ=e365-pa-nu-rw-w1188</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/_4gnYMZCikLR1HwF9xFT777YeJqNfDwch_J1D3ibZ5SLponcJDcinXdy9H0f4TNh5DFcXQEbYfycgKrn3fczFo1M16fMp3u5ks--=e365-pa-nu-rw-w1188</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/fUKw0uQrOWngZgiTJxBMCxyf4YlLKy7Chqfq0TsptPKltWh58D3fxRT2ZVZRfJQ7unAVOx624iqZdqGq0VgEYxYY69qqHwdX8LjnyA=e365-pa-nu-rw-w1536</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/fUKw0uQrOWngZgiTJxBMCxyf4YlLKy7Chqfq0TsptPKltWh58D3fxRT2ZVZRfJQ7unAVOx624iqZdqGq0VgEYxYY69qqHwdX8LjnyA=e365-pa-nu-rw-w966</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/sYGCKFdty43En6yLGeV94mfNGHXfVj-bQYitHRndarB7tHmQq_kyVxhlPejeCBVEEYUbnKG2_jUzgNXoPoer6XJm71V3uz2Z6q0CmNw=w0</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://lh3.googleusercontent.com/zkON_5G76CAXgmIWvlF8nLmoZ89UDZrxo2eYtwn-cvJIaCQrice9ycBz2cQVoG_wQ3DyrrQcFogOba9-8L22R3rIai7k9BbXZ3Q=e365-pa-nu-rw-w1472</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://one.google.com/about/plans</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://play.google.com/store/apps/details</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://play.google.com/store/apps/details?id=com.google.android.calendar&amp;hl=en_US</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://policies.google.com/privacy</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=ar</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=da</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=de</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=en_us</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=es</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=es-419</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=fi</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=fr</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=id</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=it</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=iw</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=ja</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=ko&amp;gl=kr</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=nl</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=no</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=pl</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=pt-BR</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=ru-RU</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=se</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=th</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=tr</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=uk</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=vi</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=zh-CN</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=zh-TW&amp;gl=tw</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=zh-hk&amp;gl=hk</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/terms?hl=en_us</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://storage.googleapis.com/gweb-workspace-assets/uploads/7uffzv9dk4sn-7LhoZoRSU32Sn20yI8213k-92d83d07ba564bddac887d329c3589c2-Vector.svg</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://support.google.com/a</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/a/#topic=29157</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/a/answer/1047213?hl=en&amp;ref_topic=7067151</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/a/answer/1626902?hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/a/answer/6251069</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/a/answer/6365252</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/a/topic/2798684</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/a/topic/7400801</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/a/users/?hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/a/users?hl=en_us&amp;#topic=11499463</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/calendar/answer/143753?hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/calendar/answer/16404789?hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/calendar/answer/7157782?hl=en&amp;co=GENIE.Platform%3DAndroid</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/wearos/answer/14143488?hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://support.google.com/workspace/?hl=en_us</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://twitter.com/googleworkspace</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://workspace.google.com/intl/da/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/de/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/de_ch/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/en/newsletter/thank-you/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/en_au/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/en_ca/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/en_id/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/en_ie/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/en_in/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/en_my/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/en_nz/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/en_ph/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/en_sg/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/en_uk/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/en_za/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/es-419/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/es-419_ar/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/es-419_mx/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/es-419_us/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/es/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/fi/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/fr/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/fr_ca/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/fr_ch/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/hu/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/id/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/it/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/iw/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/ja/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/intl/zh-TW/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://workspace.google.com/products/calendar/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/googleworkspace/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.google.com/a/partnersearch/?hl=en_us</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/appsstatus?hl=en_us</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/intl/en/nonprofits</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/intl/en_us/about/products/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/intl/en_us/services</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/nonprofits?hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googlecloudcommunity.com/gc/Google-Workspace/ct-p/google-workspace</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/images/branding/googleg_gradient/1x/googleg_gradient_standard_20dp.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/googleworkspace/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/showcase/googleworkspace/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.ppc.go.jp/files/pdf/USA_report.pdf</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.ppc.go.jp/files/pdf/california_report.pdf</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.ppc.go.jp/files/pdf/singapore_report.pdf</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.wikidata.org/wiki/Q509284</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/channel/UCBmwzQnSoj9b6HzNmFrg_yw/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/googleworkspace/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://x.com/googleworkspace</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://calendar.google.com/calendar/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>about.appsheet.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>about.google</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>account.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>accounts.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ads.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>app-sj24.marketo.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>apps.apple.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>businessmessages.google</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>chromeenterprise.google</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>cloud.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>cloud.googleblog.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>cloud.withgoogle.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>cloudonair.withgoogle.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>domains.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>edu.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>en.wikipedia.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>families.google</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>form-submit-service-dot-gsuite-staging.uc.r.appspot.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>goo.gle</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>gstatic.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>lh3.googleusercontent.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>one.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>play.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>policies.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>storage.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>support.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>twitter.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>workspace.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.googlecloudcommunity.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.gstatic.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.instagram.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.ppc.go.jp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.wikidata.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>x.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.127.84</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>216.239.32.29</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.94</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.15.59.224</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>216.239.32.27</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.219.138.33</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.141</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.141</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.132</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.127.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.139</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.16.95.80</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>da0e86666b9db17194e1b544b9c18f561c4228473585693f18e19a887bc188ee</SHA-256>
              <SHA-1>319a3ef7f870f028264e9a404478c037a171db07</SHA-1>
              <MD5>207c13e378784d6a96a1c9dd205ba049</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>dbd50c6e6e7911e9dfd0b174a1ce7b81e8259c3f750f8b5f55b19e6387bc93ed</SHA-256>
              <SHA-1>53500670a190baff3607f06076bc5388f8efdeac</SHA-1>
              <MD5>dbd2fcf8ba6c55207c59a4cd399aef23</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/json</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>220bcb1ca2a00dad8195df3f900f82cab60fa423364e9d9aff31559947bf15ce</SHA-256>
              <SHA-1>8d52cf5d7815d3679d1cd8f326471edfe9fd9f34</SHA-1>
              <MD5>4ddcdb6a2d207dd0277856f0549bcf60</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>d9cc1736ea1425ed8565f89ca77b4a1dc27503511f77ca11a0abc8b401dede77</SHA-256>
              <SHA-1>38c3c6c8bcc12036d31fd734c48174ebbbfbcc23</SHA-1>
              <MD5>a841dbd3d07d1f29d2a674f3443f400a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/css</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>e8f2ded5d74c0ee5f427a20b6715e65bc79ed5c4fc67fb00d89005515c8efe63</SHA-256>
              <SHA-1>ae56ea57c52d1153cec33cef91cf935d2d3af14d</SHA-1>
              <MD5>fbe36eb2eecf1b90451a3a72701e49d2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>ecd371e7a3cfbce55fceba906977f85c8beb0eea56b9f29f23ecb342eb21e376</SHA-256>
              <SHA-1>ea4f986ba0f0e7a71924ee3269a57ac7701b2622</SHA-1>
              <MD5>7f333b8720beb5cfff4fc0da2f35a0bc</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>6a1636843309e3f2d1201e6a6229e48a3e7bd0f7d043d56e1d4c7939ff4b8e9e</SHA-256>
              <SHA-1>116cbb1a0add076c18f000dfba23a94d49e05bf1</SHA-1>
              <MD5>2bf8989a19ce83f8397f7f54c4e9193e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>74ba9889186987dddfebbc7c571dfa74150aaa703135006c67ab0696decf9adc</SHA-256>
              <SHA-1>2ccbf4e4764387546cb4c195b9ec40db89ed6d75</SHA-1>
              <MD5>0d557fada29c904a56f1b0fc532b79b2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>58700830e397dfeb302d35e45527934a7d27a2d63f2fb108deb7b7843aeb7095</SHA-256>
              <SHA-1>b9d82651a39691c7385dfa4b7fdf0bc4d0ca8ccb</SHA-1>
              <MD5>55ec557a9ee768c6a764a275a762d431</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>x8a32b:$btc: 3b7ac6e9dac32136215b879b25d1682</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>hxxps://calendar.google.com/calendar/</name>
        <report_id>d13ab9e8-ee21-48e4-832f-be865bf20189</report_id>
        <tags>
          <value>html</value>
          <value>png</value>
          <value>txt</value>
          <value>json</value>
          <value>obfuscated</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>4a7fdbe6211acd7962c81f28c862b75b2b36527f0c5dc3ca91fd7251ee00f631</id>
    <title>Analysis Report for 4a7fdbe6211acd7962c81f28c862b75b2b36527f0c5dc3ca91fd7251ee00f631</title>
    <updated>2026-08-20T21:45:56Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8775ac49c2438a47b72ab7</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877593009ae7a1a8d2deea</flow_id>
        <hash>4a7fdbe6211acd7962c81f28c862b75b2b36527f0c5dc3ca91fd7251ee00f631</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schema.org/HttpActionHandler</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/HttpActionHandler</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://schema.org/favicon.ico</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>schema.org</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.250.154.138</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxp://schema.org/HttpActionHandler</name>
        <report_id>8debebc9-d935-4ee3-a8da-7ba1727d8af8</report_id>
        <tags>
          <value>html</value>
          <value>aidetect</value>
          <value>phishing</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>886bf556a8a88adc2aac86da3c8d63106e1c8e7854eb14bc1c095edc074163f8</id>
    <title>Analysis Report for 886bf556a8a88adc2aac86da3c8d63106e1c8e7854eb14bc1c095edc074163f8</title>
    <updated>2026-08-20T21:45:41Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8775d4f2677ae4d366d668</_id>
        <file_type>text/markdown</file_type>
        <flow_id>6a87757f009ae7a1a8d2de7a</flow_id>
        <hash>886bf556a8a88adc2aac86da3c8d63106e1c8e7854eb14bc1c095edc074163f8</hash>
        <iocs>
          <urls>
            <value>
              <url>https://badgen.net/coveralls/c/github/jshttp/range-parser/master</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://badgen.net/npm/dm/range-parser</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://badgen.net/npm/node/range-parser</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://badgen.net/npm/v/range-parser</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://badgen.net/travis/jshttp/range-parser/master</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://coveralls.io/r/jshttp/range-parser?branch=master</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://docs.npmjs.com/getting-started/installing-npm-packages-locally</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://nodejs.org/en/</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://nodejs.org/en/download</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://npmjs.org/package/range-parser</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://travis-ci.org/jshttp/range-parser</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.npmjs.com/).</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://badgen.net/coveralls/c/github/jshttp/range-parser/master</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://badgen.net/npm/dm/range-parser</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://badgen.net/npm/node/range-parser</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://badgen.net/npm/v/range-parser</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://badgen.net/travis/jshttp/range-parser/master</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://coveralls.io/r/jshttp/range-parser?branch=master</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://docs.npmjs.com/getting-started/installing-npm-packages-locally):</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://nodejs.org/en/)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://nodejs.org/en/download</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://npmjs.org/package/range-parser</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.npmjs.com/).</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>badgen.net</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>coveralls.io</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>docs.npmjs.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>nodejs.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>npmjs.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>npmjs.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>travis-ci.org</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>badgen.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>coveralls.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>docs.npmjs.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>nodejs.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>npmjs.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>npmjs.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>185.199.109.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.21.4.187</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.16.4.34</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.26.13.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.16.212.131</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>216.150.16.193</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.17.134.117</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>589eb8efa0d5877ec1c864a73368e8a276b97c2465a1d0d99f487c484fab5e18</SHA-256>
              <SHA-1>4ef25d2f73525402489650809c28a0da504baf28</SHA-1>
              <MD5>bcd69a6005e5a3f7b9462628b22f1b29</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/svg+xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>bf97271384734d6830a12527be4e6bb5273a42074eef042bb32cf31d1b02cb34</SHA-256>
              <SHA-1>57538cff0e780427ffde203081269d630501bee2</SHA-1>
              <MD5>4ebba311573bdb944f968bed8e1ac12a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/svg+xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>9848ae324ce2072087243a003331c32e768f109be14142b16c4975b13760356f</SHA-256>
              <SHA-1>f62b5c2d80f3f3193561b73a799344f71bf05fec</SHA-1>
              <MD5>2bf2b78332f57e0e969f8b004ac1a6a3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/svg+xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>0dadf0460e74d2bf55d982788d84b1e9cf50ca3a665d27f457be2f5231f0edd1</SHA-256>
              <SHA-1>1ecdf98af8bdd8a131fa4b620e8ed59c1d88f35c</SHA-1>
              <MD5>9249ac3d42c35c06064a2a250106f08d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/svg+xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>b2292233ad9f63e6d75b25cf86216708134133c9cee506059f6e3be04128812f</SHA-256>
              <SHA-1>6e9a923d978219921a7860d8b1e79c0d9ff8df08</SHA-1>
              <MD5>cdf6b2731a8b1addd02e1df3f3be4e56</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/svg+xml</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>3ec528a75f193f5433a1cb72b0ce7a0ddf0212ea5c8a46a40e8dc50c8218be71</SHA-256>
              <SHA-1>20e13bd9cc48f9cbd5260cef29d7b74d2cb96a1a</SHA-1>
              <MD5>7bcb591d71393033ace43c3ffc76fd37</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>e95854b924b7ac6a0697f2eaa31ec514fcb50fe180f1c0d53f75e2764cc90563</SHA-256>
              <SHA-1>59d798d7f7a2149aaa224783c1fe2cbbaf1cea48</SHA-1>
              <MD5>7d245c4a3f656e79665e5035f487f74d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>08cacac254a309d4316c3097ecea77bf49f431a78cb82d38223bc23215bd187e</SHA-256>
              <SHA-1>fed882bc71dc567bec43f255bfc961f220494e98</SHA-1>
              <MD5>5610a0a885f306d3e0758fd9ea2edb16</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>f09c475ee05cc99f97ffb440220322cf110f090a0fcf936541ed5972eb3464a9</SHA-256>
              <SHA-1>d74c96a9faa968b9116274132c7b71f37b62f864</SHA-1>
              <MD5>5edf795415a64d0075e2817faa078ef3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>4c8df4fd44fdeb2145f6140394d162418748be37c4aa952dfd8752ee25e7c7eb</SHA-256>
              <SHA-1>2d499b3fc694b9cff88a1a31f88c2f5a2aa72667</SHA-1>
              <MD5>76f6b28887ac8ffbaff739e1659b2712</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>README.md</name>
        <report_id>0b93c454-aab7-4ac1-88cc-b471a3e6c312</report_id>
        <tags>
          <value>txt</value>
          <value>html</value>
          <value>svg</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>6adb0c45a46c576215ebe05bd8746d373507ea0fe57cfd9a0dd039b7785e5a26</id>
    <title>Analysis Report for 6adb0c45a46c576215ebe05bd8746d373507ea0fe57cfd9a0dd039b7785e5a26</title>
    <updated>2026-08-20T21:45:41Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8775c7f2677ae4d366d65f</_id>
        <file_type>text/x-php</file_type>
        <flow_id>6a87757f009ae7a1a8d2de7a</flow_id>
        <hash>6adb0c45a46c576215ebe05bd8746d373507ea0fe57cfd9a0dd039b7785e5a26</hash>
        <iocs/>
        <name>config.php</name>
        <report_id>7d144595-0b5d-411b-b2bb-47b577b713e8</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0edf3fa4c4ef2e1a6e8b2450d60ceeab4d853f74a5229b0e5e8379ed4f9c5fe5</id>
    <title>Analysis Report for 0edf3fa4c4ef2e1a6e8b2450d60ceeab4d853f74a5229b0e5e8379ed4f9c5fe5</title>
    <updated>2026-08-20T21:45:41Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8775c8f2677ae4d366d662</_id>
        <file_type>text/x-php</file_type>
        <flow_id>6a87757f009ae7a1a8d2de7a</flow_id>
        <hash>0edf3fa4c4ef2e1a6e8b2450d60ceeab4d853f74a5229b0e5e8379ed4f9c5fe5</hash>
        <iocs/>
        <name>manifest.php</name>
        <report_id>35a12add-e406-4747-8370-c8f082855ec8</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>331882db5e3977abc2f2293eb71bfced342b88b7e19f0e6b3c46c8f4523f2531</id>
    <title>Analysis Report for 331882db5e3977abc2f2293eb71bfced342b88b7e19f0e6b3c46c8f4523f2531</title>
    <updated>2026-08-20T21:45:41Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8775caf2677ae4d366d664</_id>
        <file_type>application/xml</file_type>
        <flow_id>6a87757f009ae7a1a8d2de7a</flow_id>
        <hash>331882db5e3977abc2f2293eb71bfced342b88b7e19f0e6b3c46c8f4523f2531</hash>
        <iocs/>
        <name>wpml-config.xml</name>
        <report_id>7a334a67-1507-4347-95ff-1c7647a20b27</report_id>
        <tags>
          <value>xml</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855</id>
    <title>Analysis Report for e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855</title>
    <updated>2026-08-20T21:45:41Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877587f2677ae4d366d644</_id>
        <file_type>text/html</file_type>
        <flow_id>6a87757f009ae7a1a8d2de7a</flow_id>
        <hash>e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855</hash>
        <iocs/>
        <name>index.html</name>
        <report_id>2be0e09b-d066-4744-982d-afcf475752fe</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0975ef0ae6624f93458b1500f0fa3dad2ad9e1bf243dbc706c20aebaaaf08601</id>
    <title>Analysis Report for 0975ef0ae6624f93458b1500f0fa3dad2ad9e1bf243dbc706c20aebaaaf08601</title>
    <updated>2026-08-20T21:44:45Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877591f2677ae4d366d64e</_id>
        <file_type>application/pdf</file_type>
        <flow_id>6a87754b5a70bef4cd151b3e</flow_id>
        <hash>0975ef0ae6624f93458b1500f0fa3dad2ad9e1bf243dbc706c20aebaaaf08601</hash>
        <iocs>
          <urls>
            <value>
              <url>http://www.worksafebc.com/</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.worksafebc.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>worksafebc.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.worksafebc.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>worksafebc.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>52.228.84.34</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>38e52df48cb8d546eac80fd011cca59b79da9bd422fbf6094de9195d3db6685e</SHA-256>
              <SHA-1>b9cc507b9311b61b987454e012928d81b3fea290</SHA-1>
              <MD5>212706d39db786fa7db80582595a66fa</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>7ecbbfd9029aa9d3485d9d83039f453fb921ef8dee692440524e069046052264</SHA-256>
              <SHA-1>746fdcf3ab423eec90ce3a7b605c7851560215be</SHA-1>
              <MD5>2a04fbc9ee2dd5e57934dcb1a2e26e01</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>b7194efb3e46980cda06a0416796b49e89f2d01cae068c2c514c5fa0c46c2ad9</SHA-256>
              <SHA-1>ccc05555eb7045184e6b0b91df55ed3c63190d64</SHA-1>
              <MD5>b392373589b00b2f9bea2759c9840491</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>aaa.pdf</name>
        <report_id>dd8bede9-6c9f-4bc4-a0c7-08f4d02bf0b2</report_id>
        <tags>
          <value>pdf</value>
          <value>html</value>
          <value>anti-vm</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>fda16758bdf3aa61baa0b598bd419f1dae695787d8f8dd9da8fea4629bf041d2</id>
    <title>Analysis Report for fda16758bdf3aa61baa0b598bd419f1dae695787d8f8dd9da8fea4629bf041d2</title>
    <updated>2026-08-20T21:44:38Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877576f2677ae4d366d640</_id>
        <file_type>text/x-ini</file_type>
        <flow_id>6a87754567502b6ca997ae03</flow_id>
        <hash>fda16758bdf3aa61baa0b598bd419f1dae695787d8f8dd9da8fea4629bf041d2</hash>
        <iocs/>
        <name>g_Need For Speed Heat.ini</name>
        <report_id>7e7c3326-6308-4941-902a-c17328ee2714</report_id>
        <tags>
          <value>txt</value>
          <value>ini</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>1d958849692862c419812dbf80570edb694f7c7e1c4758b6fa897be09c705b08</id>
    <title>Analysis Report for 1d958849692862c419812dbf80570edb694f7c7e1c4758b6fa897be09c705b08</title>
    <updated>2026-08-20T21:44:38Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877589f2677ae4d366d648</_id>
        <file_type>text/x-ini</file_type>
        <flow_id>6a87754567502b6ca997ae03</flow_id>
        <hash>1d958849692862c419812dbf80570edb694f7c7e1c4758b6fa897be09c705b08</hash>
        <iocs/>
        <name>g_GRID Legends.ini</name>
        <report_id>7ee2fbc7-1b25-403f-8b11-f5c97c246194</report_id>
        <tags>
          <value>txt</value>
          <value>ini</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ccb99a4a44eab034b26811d5e0902857667a73d113a246a67ccbf42517c3d65e</id>
    <title>Analysis Report for ccb99a4a44eab034b26811d5e0902857667a73d113a246a67ccbf42517c3d65e</title>
    <updated>2026-08-20T21:44:38Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87758bf2677ae4d366d64b</_id>
        <file_type>text/x-ini</file_type>
        <flow_id>6a87754567502b6ca997ae03</flow_id>
        <hash>ccb99a4a44eab034b26811d5e0902857667a73d113a246a67ccbf42517c3d65e</hash>
        <iocs/>
        <name>g_Cities Skylines.ini</name>
        <report_id>961661e1-7cb7-4552-97e7-1537f58e3071</report_id>
        <tags>
          <value>txt</value>
          <value>ini</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>070ac609263921f4c91061f8c8ddd78a3305038ec3f13f4fe265ae715f2c0b89</id>
    <title>Analysis Report for 070ac609263921f4c91061f8c8ddd78a3305038ec3f13f4fe265ae715f2c0b89</title>
    <updated>2026-08-20T21:44:38Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877588f2677ae4d366d646</_id>
        <file_type>text/x-ini</file_type>
        <flow_id>6a87754567502b6ca997ae03</flow_id>
        <hash>070ac609263921f4c91061f8c8ddd78a3305038ec3f13f4fe265ae715f2c0b89</hash>
        <iocs/>
        <name>g_Need For Speed Most Wanted.ini</name>
        <report_id>0fddc687-823a-4688-a5ed-51b807ef010d</report_id>
        <tags>
          <value>txt</value>
          <value>ini</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>cf784476719a93e3fb8457a2d4c4580b691b6d04592b9a4467acf563f30d2b83</id>
    <title>Analysis Report for cf784476719a93e3fb8457a2d4c4580b691b6d04592b9a4467acf563f30d2b83</title>
    <updated>2026-08-20T21:44:38Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8775a8f2677ae4d366d654</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a87754567502b6ca997ae03</flow_id>
        <hash>cf784476719a93e3fb8457a2d4c4580b691b6d04592b9a4467acf563f30d2b83</hash>
        <iocs>
          <urls>
            <value>
              <url>https://gist.githubusercontent.com/anadius/4f00ba9111c2c4c05f97decd6018f279/raw/g_</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>gist.githubusercontent.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>2.1.2.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.109.133</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df</SHA-256>
              <SHA-1>4260284ce14278c397aaf6f389c1609b0ab0ce51</SHA-1>
              <MD5>1e4a89b11eae0fcf8bb5fdd5ec3b6f61</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>f89beba83767dbe098b0f5691554890eced565fa0f84f11e874ee4d19dcaac34</SHA-256>
              <SHA-1>2572387f81560f4236b353e01754982e8b8d2319</SHA-1>
              <MD5>1f735b1262af28e3a32ae5db13b9305d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>version.dll</name>
        <report_id>43b359c5-e3ba-48f3-94e3-2105db4b97d4</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>evasive</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>70553a2b4d53eddf1eeb290e346a9b562c71f52d46874bfb708e9d962469a736</id>
    <title>Analysis Report for 70553a2b4d53eddf1eeb290e346a9b562c71f52d46874bfb708e9d962469a736</title>
    <updated>2026-08-20T21:44:38Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8775b6f2677ae4d366d658</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a87754567502b6ca997ae03</flow_id>
        <hash>70553a2b4d53eddf1eeb290e346a9b562c71f52d46874bfb708e9d962469a736</hash>
        <iocs>
          <urls>
            <value>
              <url>https://gist.githubusercontent.com/anadius/4f00ba9111c2c4c05f97decd6018f279/raw/g_</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>gist.githubusercontent.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>185.199.109.133</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df</SHA-256>
              <SHA-1>4260284ce14278c397aaf6f389c1609b0ab0ce51</SHA-1>
              <MD5>1e4a89b11eae0fcf8bb5fdd5ec3b6f61</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>74759f5acc4294b577096ec924ec82f06f2350106671177c00941d3deca9be66</SHA-256>
              <SHA-1>de155ba535329737a7624bea681ef24b38aafc20</SHA-1>
              <MD5>eec732daee033914038d15882e828cf0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>version.dll</name>
        <report_id>5d42bd76-219e-41dd-864f-c0ff9208b459</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>anti-vm</value>
          <value>lolbin</value>
          <value>schtasks</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a92107a9a24d5a80dc958f7b31bc581de7d3a2664aef10121307adbfc6c96cd4</id>
    <title>Analysis Report for a92107a9a24d5a80dc958f7b31bc581de7d3a2664aef10121307adbfc6c96cd4</title>
    <updated>2026-08-20T21:44:38Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8775c2f2677ae4d366d65c</_id>
        <file_type>text/x-ini</file_type>
        <flow_id>6a87754567502b6ca997ae03</flow_id>
        <hash>a92107a9a24d5a80dc958f7b31bc581de7d3a2664aef10121307adbfc6c96cd4</hash>
        <iocs/>
        <name>g_This War of Mine.ini</name>
        <report_id>b735ee89-7de2-49d4-9634-c8764d805584</report_id>
        <tags>
          <value>txt</value>
          <value>ini</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>efb0ccb854fdda4cdb9f3b2d5c20c35ce81b77e8db8ebf3e9657287e278ca9a9</id>
    <title>Analysis Report for efb0ccb854fdda4cdb9f3b2d5c20c35ce81b77e8db8ebf3e9657287e278ca9a9</title>
    <updated>2026-08-20T21:44:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87755ff2677ae4d366d63a</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8775315a70bef4cd151b08</flow_id>
        <hash>efb0ccb854fdda4cdb9f3b2d5c20c35ce81b77e8db8ebf3e9657287e278ca9a9</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cdn.cookielaw.org/consent/b10039eb-ccf8-4794-a917-19d5f16279a7/OtAutoBlock.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.cookielaw.org/scripttemplates/otSDKStub.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Chivo:ital,wght@0,300;0,400;0,700;1,400;1,700&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://go.graebel.com/mobility-program-health-assessment</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://secure.gravatar.com/avatar/6edde51c5563740ebdcbb03238808d04a881267d504b6ad9e8e1f3d43c9424fe?s=96&amp;amp;d=mm&amp;amp;r=g</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://submit-irm.trustarc.com/services/validation/313667ff-53c6-4567-ad0b-8675c05338e7</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://twitter.com/GraebelRelo</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://use.typekit.net/fmw1gic.css</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://www.cityswitcher.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/GraebelCompanies/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/ns.html?id=GTM-MP3BCF&amp;gtm_auth=aMaw4XCr8W6um9glldl9Bg&amp;gtm_preview=env-2&amp;gtm_cookies_win=x</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.graebel.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.graebel.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/about-us/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/about-us/diversity-equity-inclusion/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/about-us/global-footprint/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/about-us/information-security/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/about-us/supplier-network/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/about-us/sustainability/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/capabilities/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/careers/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/contact/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/de/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/es/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/events/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/fr/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/insights/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/it/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/legal/modern-slavery-act-statement/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/legal/notice-of-data-event/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/legal/privacy-policy/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/luminate-technology-platform/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/solutions/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/solutions/global-payroll-operations/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/solutions/hr-vendor-management/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/solutions/people-operations/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/solutions/talent-mobility/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/solutions/travel-stay-compliance/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/solutions/workforce-strategy-and-planning/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/why-graebel/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/zh-CN/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/graebel-companies</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.youtube.com/user/GraebelRelocation</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://ad.doubleclick.net/ccm/s/collect?auid=1681621465.1787262264&amp;gtm=45He68j0v72651149za200zd72651149xea&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.cookielaw.org/consent/b10039eb-ccf8-4794-a917-19d5f16279a7/35ff0be5-db07-4c22-97a0-72a0ef7422f5/en.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.cookielaw.org/consent/b10039eb-ccf8-4794-a917-19d5f16279a7/OtAutoBlock.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.cookielaw.org/consent/b10039eb-ccf8-4794-a917-19d5f16279a7/b10039eb-ccf8-4794-a917-19d5f16279a7.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.cookielaw.org/logos/72cbe908-8d2e-41f4-aaf4-8d84c87afd85/019f61c8-3cc8-7fa1-b9a3-092bc2e94126/d8b363d2-0ea7-4918-8469-61561385ca51/onetrust-cooke-icon-small-aubergine.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.cookielaw.org/logos/72cbe908-8d2e-41f4-aaf4-8d84c87afd85/81bc55f6-af51-4495-bd6f-9561bd6f5ffb/bd323208-85ed-4cd1-bd0d-76becaa66eb5/GRAEBEL-logo-100px-w.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.cookielaw.org/logos/static/powered_by_logo.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.cookielaw.org/scripttemplates/202606.1.0/assets/otCommonStyles.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.cookielaw.org/scripttemplates/202606.1.0/assets/otCookieSettingsButton.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.cookielaw.org/scripttemplates/202606.1.0/assets/otFloatingRounded.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.cookielaw.org/scripttemplates/202606.1.0/assets/v2/otPcPanel.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.cookielaw.org/scripttemplates/202606.1.0/otBannerSdk.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.cookielaw.org/scripttemplates/otSDKStub.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cookiepedia.co.uk/giving-consent-to-cookies</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://embed-ssl.wistia.com/deliveries/bda514ced36fb623a11cd3ea3f8ef792e014a3ca.mp4</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Chivo:ital,wght@0,300;0,400;0,700;1,400;1,700&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://go.graebel.com/mobility-program-health-assessment</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://p.typekit.net/p.css?s=1&amp;k=fmw1gic&amp;ht=tk&amp;f=15543.21706.22626.22628&amp;a=83397008&amp;app=typekit&amp;e=css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.ads.linkedin.com/attribution_trigger</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.ads.linkedin.com/attribution_trigger?pid=5040916%2C90788&amp;time=1787262264233&amp;url=https%3A%2F%2Fwww.graebel.com%2F&amp;tm=gtmv2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.ads.linkedin.com/attribution_trigger?pid=5040916%2C90788&amp;time=1787262264234&amp;url=https%3A%2F%2Fwww.graebel.com%2F&amp;tm=gtmv2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.ads.linkedin.com/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.ads.linkedin.com/collect?v=2&amp;fmt=js&amp;pid=5040916%2C90788&amp;time=1787262264233&amp;url=https%3A%2F%2Fwww.graebel.com%2F&amp;tm=gtmv2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.ads.linkedin.com/collect?v=2&amp;fmt=js&amp;pid=5040916%2C90788&amp;time=1787262264234&amp;url=https%3A%2F%2Fwww.graebel.com%2F&amp;tm=gtmv2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://px.ads.linkedin.com/wa/?medium=fetch&amp;fmt=g</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://snap.licdn.com/li.lms-analytics/insight.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://snap.licdn.com/li.lms-analytics/insight.old.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://submit-irm.trustarc.com/services/validation/313667ff-53c6-4567-ad0b-8675c05338e7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://twitter.com/GraebelRelo</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://use.typekit.net/fmw1gic.css</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.cityswitcher.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/GraebelCompanies/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google.com/ccm/collect?rcb=9&amp;frm=0&amp;apvc=1&amp;ae=g&amp;auid=1681621465.1787262264&amp;dt=Graebel%20%7C%20Global%20Relocation%20Services%20%26%20Mobility%20Solutions&amp;en=page_view&amp;dl=https%3A%2F%2Fwww.graebel.com%2F&amp;scrsrc=www.googletagmanager.com&amp;rnd=1096832081.1787262264&amp;navt=n&amp;npa=1&amp;ep.ads_data_redaction=0&amp;gtm=45He68j0v72651149za200zd72651149xea&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616986~115938466~115938469~118897920~118897930~120315471~120385422&amp;tft=1787262264105&amp;tfd=608&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=GTM-MP3BCF&amp;gtm_auth=aMaw4XCr8W6um9glldl9Bg&amp;gtm_preview=env-2&amp;gtm_cookies_win=x</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.graebel.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/about-us/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/about-us/diversity-equity-inclusion/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/about-us/global-footprint/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/about-us/information-security/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/about-us/supplier-network/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/about-us/sustainability/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/capabilities/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/careers/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/contact/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/de/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/es/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/events/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/fr/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/insights/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/it/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/legal/modern-slavery-act-statement/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/legal/notice-of-data-event/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/legal/privacy-policy/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/legal/terms-of-use/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/luminate-technology-platform/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/privacy-policy/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/site-map/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/solutions/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/solutions/global-payroll-operations/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/solutions/hr-vendor-management/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/solutions/people-operations/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/solutions/talent-mobility/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/solutions/travel-stay-compliance/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/solutions/workforce-strategy-and-planning/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/why-graebel/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/plugins/embedpress-pro/Gutenberg/dist/blocks.style.build.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/plugins/embedpress/assets/css/blocks.build.css?ver=1786189095</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/plugins/embedpress/assets/css/embedpress.css?ver=1786189095</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/plugins/gtranslate/flags/svg/en.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/plugins/gtranslate/js/dwf.js?ver=3.1.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/themes/gbl2026/dist/fonts/roboto-serif-latin-wght-normal.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/themes/gbl2026/dist/fonts/source-sans-3-latin-wght-italic.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/themes/gbl2026/dist/fonts/source-sans-3-latin-wght-normal.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/themes/gbl2026/dist/images/facebook.svg?id=80ac8bbc81a2be0dce75</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/themes/gbl2026/dist/images/linkedin.svg?id=98b99c0270706e57e77b</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/themes/gbl2026/dist/images/logo-x.svg?id=0c9462a79f736453eac5</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/themes/gbl2026/dist/images/youtube.svg?id=3f12ffa76cc6a59697c6</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/themes/gbl2026/dist/scripts/global.js?id=4207628463ffe9463a7a</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/themes/gbl2026/dist/scripts/homepage.js?id=f9e172c9eb8a2ab94ada</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/themes/gbl2026/dist/scripts/vendor.js?id=f39c9add40c204f3ff70</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/themes/gbl2026/dist/styles/global.css?id=a7582a81eb8193029705</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/themes/gbl2026/dist/styles/homepage.css?id=91a94c1bdb482c73095a</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/uploads/2021/04/hero-services-1024x252.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/uploads/2023/03/favicon-32x32-2.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/uploads/2023/05/privacyoptions29x14.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/uploads/2026/07/Background-1024x410.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/uploads/2026/07/blue_horizontal-logo.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/uploads/2026/07/blue_vertical_logo.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/uploads/2026/07/cc1.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/uploads/2026/07/cc2.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/uploads/2026/07/cc3.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/uploads/2026/07/icon1.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/uploads/2026/07/icon2.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/uploads/2026/07/icon3.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/uploads/2026/07/icon4.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/uploads/2026/07/icon5.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/uploads/2026/07/icon6.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/uploads/2026/07/image-1.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-content/uploads/2026/07/split-1.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-includes/css/dist/block-editor/style.min.css?ver=6.9.7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-includes/css/dist/components/style.min.css?ver=6.9.7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-includes/css/dist/editor/style.min.css?ver=6.9.7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-includes/css/dist/patterns/style.min.css?ver=6.9.7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-includes/css/dist/preferences/style.min.css?ver=6.9.7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-includes/css/dist/reusable-blocks/style.min.css?ver=6.9.7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-includes/js/dist/vendor/react-dom.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-includes/js/dist/vendor/react-dom.min.js?ver=18.3.1.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-includes/js/dist/vendor/react.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-includes/js/dist/vendor/react.min.js?ver=18.3.1.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.graebel.com/zh-CN/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/graebel-companies</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.onetrust.com/solutions/consent-and-preferences/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.youtube.com/user/GraebelRelocation</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>18.3.1.1</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.graebel.com/&amp;scrsrc=www.googletagmanager.com&amp;rnd=1096832081.1787262264&amp;navt=n&amp;npa=1&amp;ep.ads_data_redaction=0&amp;gtm=45He68j0v72651149za200zd72651149xea&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616986~115938466~115938469~118897920~118897930~120315471~120385422&amp;tft=1787262264105&amp;tfd=608&amp;fmt=8</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.graebel.com/&amp;tm=gtmv2</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cdn.cookielaw.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>go.graebel.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>graebel.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>secure.gravatar.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>submit-irm.trustarc.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>twitter.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>use.typekit.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.cityswitcher.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.graebel.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ad.doubleclick.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cdn.cookielaw.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cookiepedia.co.uk</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>embed-ssl.wistia.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>go.graebel.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>p.typekit.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>px.ads.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>snap.licdn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>submit-irm.trustarc.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>twitter.com</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>use.typekit.net</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>www.cityswitcher.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.graebel.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.onetrust.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.youtube.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>192.0.73.2</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>162.159.140.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.64.146.215</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>141.193.213.20</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>54.236.81.128</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.154.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>199.60.103.30</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>184.24.77.165</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>18.233.21.215</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.113</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.87.42</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>141.193.213.20</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.110.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.151.119</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.149</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>172.64.146.215</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>184.24.77.134</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>184.24.77.169</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>23.55.161.136</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>65.9.130.9</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.86.42</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.94</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>157.240.253.35</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>47217c062e1bec38b6b4832297ef8adf0ccfefd46caa5638cad5a8c8b1d71377</SHA-256>
              <SHA-1>c791fb997a88eb144bd132e9501697fe9a1c0b6f</SHA-1>
              <MD5>479c75bcabd433a809c001337cb7ef72</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>220bcb1ca2a00dad8195df3f900f82cab60fa423364e9d9aff31559947bf15ce</SHA-256>
              <SHA-1>8d52cf5d7815d3679d1cd8f326471edfe9fd9f34</SHA-1>
              <MD5>4ddcdb6a2d207dd0277856f0549bcf60</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>0822da59a977376307eec8d4b89e38f877395da2e8df1e3f26f0c656318a8664</SHA-256>
              <SHA-1>1970914a3aaea13d1c1a8d470c2a6028f560a9fe</SHA-1>
              <MD5>a15aab95275142edf8c653ec7cbbbdf2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/css</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>a48111c4e7db22fda49735efbc9146bd533ff10ef1394bd7c3105dd3f59dafa7</SHA-256>
              <SHA-1>f6a377a843fa3209e17b3e3ce99001f801aa92fe</SHA-1>
              <MD5>07cc4c05f877ceddf037c9fb21ac0065</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>795a38eceb2a602e68831bd4754d01ce3279c950b8ef587e3c04893f8a2837f9</SHA-256>
              <SHA-1>e0543abb1d43ca19956c0b97806810913aee44a6</SHA-1>
              <MD5>46661113681fc68d98ebf27f65ed09cd</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/css</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>3f11e3c19afe3c7f1d424868acf7e532c760e34f947baffd03fd967536287a3e</SHA-256>
              <SHA-1>23207db2e5f671ef4cd344a8e28dd2c838a164ed</SHA-1>
              <MD5>59ed6c32f42a2a29b9e14e508a9bec7c</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>e70b8ebe0f4e5ec09df13583c2c30aa4d9291d8c287c5995ff28f8140489cce7</SHA-256>
              <SHA-1>8198ccbc0598e3206f5f75a63926d6330da21249</SHA-1>
              <MD5>f5691253fc471a9956bf12dc111852b3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>512791a3a47f4481c170b3d8d8f8eb2646f83ce065b521e2659b73d3ab7f2c13</SHA-256>
              <SHA-1>0f4a6444348f9bd8ad20742ba6935d2d33245d6a</SHA-1>
              <MD5>00e18ce007272081f06532f6f2ee5115</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>beecb41ed7f9904dfac6152c0e8237e5882f799ef9be96fcedb8d1725a423796</SHA-256>
              <SHA-1>eadfc92e8d23dac9a0c40cbb0bc13d5e15e8825d</SHA-1>
              <MD5>3a7da335eec3fd2e2ea543d88bc1cc58</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>313667ff-53c6-4567-ad0b-8675c05338e7</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>b10039eb-ccf8-4794-a917-19d5f16279a7</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://www.graebel.com/</name>
        <report_id>c15ceca6-1429-49e1-a2b8-74787fa828c1</report_id>
        <tags>
          <value>txt</value>
          <value>html</value>
          <value>png</value>
          <value>javascript</value>
          <value>captcha</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>630a30550325f30bc40ba305bdba06ae02de42cd87326e199cb3589c25f547fb</id>
    <title>Analysis Report for 630a30550325f30bc40ba305bdba06ae02de42cd87326e199cb3589c25f547fb</title>
    <updated>2026-08-20T21:42:22Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8774dcf2677ae4d366d61a</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8774bc67502b6ca997adc8</flow_id>
        <hash>630a30550325f30bc40ba305bdba06ae02de42cd87326e199cb3589c25f547fb</hash>
        <iocs>
          <urls>
            <value>
              <url>https://elongatedtimes.online/?sub5</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://elongatedtimes.online/cdn-cgi/images/cf-icon-browser.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://elongatedtimes.online/cdn-cgi/images/cf-icon-cloud.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://elongatedtimes.online/cdn-cgi/images/cf-icon-error.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://elongatedtimes.online/cdn-cgi/images/cf-icon-ok.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://elongatedtimes.online/cdn-cgi/images/cf-icon-server.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://elongatedtimes.online/cdn-cgi/styles/main.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://elongatedtimes.online/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing?utm_source=errorcode_502&amp;utm_campaign=elongatedtimes.online</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>elongatedtimes.online</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>elongatedtimes.online</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing?utm_source=errorcode_502&amp;utm_campaign=elongatedtimes.online</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://elongatedtimes.online/?sub5</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>elongatedtimes.online</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.cloudflare.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>172.67.200.163</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.16.124.96</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>c74061915907ce028c6694cbf1e3749c8a82d4acb6e1cb85a075831ee6c09112</SHA-256>
              <SHA-1>529e0bb699c8815524dab96a9966b0e37f92b5dd</SHA-1>
              <MD5>3a2ccab7ba112bbc3b87525dd6e6fa40</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>28e78134078d526ced174981e705a62715891da800a302ec1a2754899645c731</SHA-256>
              <SHA-1>34855fcc82fc786bd90b9b9a31b4431717273ed0</SHA-1>
              <MD5>a962ea93a872a90a5c79dd598ae01d6e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://elongatedtimes.online/?sub5</name>
        <report_id>491ab84c-e14d-4c3f-82e1-8916fe02c5a3</report_id>
        <tags>
          <value>html</value>
          <value>aidetect</value>
          <value>phishing</value>
          <value>captcha</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9f38509c4c5bd3164c2c4ca810bad48ad1c39cdfc834af91d240751638d4fdd0</id>
    <title>Analysis Report for 9f38509c4c5bd3164c2c4ca810bad48ad1c39cdfc834af91d240751638d4fdd0</title>
    <updated>2026-08-20T21:40:58Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8774b0f2677ae4d366d60d</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6a8774680dfb99c1ceb09571</flow_id>
        <hash>9f38509c4c5bd3164c2c4ca810bad48ad1c39cdfc834af91d240751638d4fdd0</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>97d07681f758bba1418dc67557c74105bd3d6d3f91392fe6dd550823973a5080</SHA-256>
              <SHA-1>c888ec503b95d644b4b9bed3d611d18ba9c1ba1a</SHA-1>
              <MD5>07852cd58d8f72ca57b61f97153f25ea</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>0181e39e71ab3a0ac643f5209d7cf02930dcecf150f248b50fe45868050ac596</SHA-256>
              <SHA-1>acece67941791a883f9ecfd14bbdfae934da4eaa</SHA-1>
              <MD5>b54e46b9754f193ea3e0afbea83e8f1e</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>1dedeed02905063d0c71c1a6b23007177b1944dd84381548f96d9aa3c3953cf8</SHA-256>
              <SHA-1>e4a6ff034663b71f27dd7abab0027ca39339d057</SHA-1>
              <MD5>17cc7444123af039bb54ee1377adab51</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>322f385acc8edbc23e78c106336f42cf0887c70944aad162aee17c1576a6c074</SHA-256>
              <SHA-1>8b36f27d9e7c5029ed82aaf2011c698b652f78df</SHA-1>
              <MD5>2eda233e9e285a94e2b938c2cdb2a4d8</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>384ffa3671226deab093c0929d8e74424cf06c9b093a8ac59efae58fc9359ba8</SHA-256>
              <SHA-1>ded4e1e8d3816ed9db89d3ebe26d5e3a2d260d42</SHA-1>
              <MD5>9932fde19def6205d99bd98b37b4e792</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>68add10c42fe9097112370262ef013de68201e5a5af3449c94f1c3a869234b82</SHA-256>
              <SHA-1>65908d6de9c42b96856b012a1859d6f2edebb812</SHA-1>
              <MD5>18b47579466178e4537667b5d430735f</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>6a31a26fb63831bc98a09f585976fc2669b04add389110e430410cf8ecef09f8</SHA-256>
              <SHA-1>38de876cc6a14b372b5f0be5facc304a042df40e</SHA-1>
              <MD5>cef4cab819be8a72096fd6ae3352ae95</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>7e954bb71586974465c0f3ab161ce418e7efd42146077da64cebc285a5b41adc</SHA-256>
              <SHA-1>ad1d5cd8f71d2024f4375ecff37b31c445ee3a79</SHA-1>
              <MD5>36eabb4abcd8ae7464db9a2eb77bdc1d</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>b1e42b850943622be073c93b09cc2c4f70539067f3c274e8a3ba3da918b04a81</SHA-256>
              <SHA-1>8bb122872367ef13ece8d434ea506a80141cba8b</SHA-1>
              <MD5>6268564f77b9835e3810037ba25aedad</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>d5fde050de74f4301b7c944db1abfca9cf57e90d548f0ec830c7c8cdd5014102</SHA-256>
              <SHA-1>60d1a0e360dff65db4c5e721f54399f697f35416</SHA-1>
              <MD5>c2dd8c685d6fec018e0857bdee859d9a</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>text/plain</file_type>
            </value>
            <value>
              <SHA-256>ec834b70f707ca3b12153d3727ea20faf67a0f8e341064821dab94bfa8a1227d</SHA-256>
              <SHA-1>d72abd241a3960a37755203fa016b4b5759f1a5a</SHA-1>
              <MD5>4db3003457ca9ce052419b025c8b996b</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>Atlas Remade (1).dll</name>
        <report_id>3b45e95d-dac3-4ad2-ac93-ea712709260a</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>dotnet_pe</value>
          <value>njrat</value>
          <value>base64</value>
          <value>reconnaissance</value>
          <value>byteguard</value>
          <value>obfuscated</value>
          <value>packed</value>
          <value>xerinfuscator</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>cf221c4d81ed9c7594569d2d734137551dd61617e605fbbb176573f7765ccd9c</id>
    <title>Analysis Report for cf221c4d81ed9c7594569d2d734137551dd61617e605fbbb176573f7765ccd9c</title>
    <updated>2026-08-20T21:38:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877416a7edcf8232f85d20</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6a8773cbf72d6ce80a272f64</flow_id>
        <hash>cf221c4d81ed9c7594569d2d734137551dd61617e605fbbb176573f7765ccd9c</hash>
        <iocs>
          <ips>
            <value>
              <ip>209.141.37.163</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>31.76.29.161</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <btc_wallets>
            <value>
              <btc_wallet>145198da9cd23c6444664bc95e27e393</btc_wallet>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>cf221c4d81ed9c7594569d2d734137551dd61617e605fbbb176573f7765ccd9c.elf</name>
        <report_id>e8af51d2-f933-4372-acdc-dd003aacde0b</report_id>
        <tags>
          <value>elf</value>
          <value>mirai</value>
          <value>dropper</value>
          <value>gcc</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a2e625d34e39dc17cf27514e2c9be879f51a5287742aa54e4042774a2ab36e24</id>
    <title>Analysis Report for a2e625d34e39dc17cf27514e2c9be879f51a5287742aa54e4042774a2ab36e24</title>
    <updated>2026-08-20T21:38:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877412a7edcf8232f85d1e</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6a8773c60dfb99c1ceb09308</flow_id>
        <hash>a2e625d34e39dc17cf27514e2c9be879f51a5287742aa54e4042774a2ab36e24</hash>
        <iocs>
          <urls>
            <value>
              <url>https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>bugs.launchpad.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>keld@dkuug.dk</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>209.141.37.163</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>31.76.29.161</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.125.189.223</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <btc_wallets>
            <value>
              <btc_wallet>1c2b3645de89bbf3a496dde124dcf491</btc_wallet>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>a2e625d34e39dc17cf27514e2c9be879f51a5287742aa54e4042774a2ab36e24.elf</name>
        <report_id>347ed736-241c-4d72-835c-4e180d98240f</report_id>
        <tags>
          <value>elf</value>
          <value>mirai</value>
          <value>dropper</value>
          <value>gcc</value>
          <value>predictive-alin</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>39bec31855dd28e97cefa1324ef32239ef8b4057a6cec73235104f9c2e37bdb3</id>
    <title>Analysis Report for 39bec31855dd28e97cefa1324ef32239ef8b4057a6cec73235104f9c2e37bdb3</title>
    <updated>2026-08-20T21:38:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8773e0a7edcf8232f85d13</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6a8773c9099a97c449ef490e</flow_id>
        <hash>39bec31855dd28e97cefa1324ef32239ef8b4057a6cec73235104f9c2e37bdb3</hash>
        <iocs>
          <urls>
            <value>
              <url>https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>bugs.launchpad.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>keld@dkuug.dk</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>209.141.37.163</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>31.76.29.161</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.125.189.223</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
        </iocs>
        <name>39bec31855dd28e97cefa1324ef32239ef8b4057a6cec73235104f9c2e37bdb3.elf</name>
        <report_id>2e302046-290e-485a-b9cc-a1f746e7c6de</report_id>
        <tags>
          <value>elf</value>
          <value>mirai</value>
          <value>dropper</value>
          <value>gcc</value>
          <value>predictive-alin</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>edfa292a63fa4b57855d2caae989243189435f4ee043ddbc5ee14c0652ed3694</id>
    <title>Analysis Report for edfa292a63fa4b57855d2caae989243189435f4ee043ddbc5ee14c0652ed3694</title>
    <updated>2026-08-20T21:38:14Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8773dda7edcf8232f85d11</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6a8773c4099a97c449ef490c</flow_id>
        <hash>edfa292a63fa4b57855d2caae989243189435f4ee043ddbc5ee14c0652ed3694</hash>
        <iocs>
          <urls>
            <value>
              <url>https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>bugs.launchpad.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>keld@dkuug.dk</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>209.141.37.163</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>31.76.29.161</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.125.189.223</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <btc_wallets>
            <value>
              <btc_wallet>31b881f1667f4625fbdf8a54e2a8d1aa</btc_wallet>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>edfa292a63fa4b57855d2caae989243189435f4ee043ddbc5ee14c0652ed3694.elf</name>
        <report_id>7623d456-657d-476a-aa00-f2a603ad6373</report_id>
        <tags>
          <value>elf</value>
          <value>mirai</value>
          <value>dropper</value>
          <value>predictive-alin</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8b605293f44876a772582d5809bc11218e5eb6ed03dca507f75ee24afd83ac08</id>
    <title>Analysis Report for 8b605293f44876a772582d5809bc11218e5eb6ed03dca507f75ee24afd83ac08</title>
    <updated>2026-08-20T21:38:11Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8773d0a7edcf8232f85d0d</_id>
        <file_type>application/x-executable</file_type>
        <flow_id>6a8773c1099a97c449ef490a</flow_id>
        <hash>8b605293f44876a772582d5809bc11218e5eb6ed03dca507f75ee24afd83ac08</hash>
        <iocs>
          <ips>
            <value>
              <ip>31.77.227.119</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
        </iocs>
        <name>8b605293f44876a772582d5809bc11218e5eb6ed03dca507f75ee24afd83ac08.elf</name>
        <report_id>f729f1ef-f9a2-4429-b0c3-ac8086600b97</report_id>
        <tags>
          <value>elf</value>
          <value>bashlite</value>
          <value>mirai</value>
          <value>dropper</value>
          <value>predictive-alin</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>68832075fbc41bf7754a809b6781b13d85b131677abfa38aeaa65954d4b4ee36</id>
    <title>Analysis Report for 68832075fbc41bf7754a809b6781b13d85b131677abfa38aeaa65954d4b4ee36</title>
    <updated>2026-08-20T21:35:35Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877361f2677ae4d366d5b0</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6a877326f72d6ce80a272def</flow_id>
        <hash>68832075fbc41bf7754a809b6781b13d85b131677abfa38aeaa65954d4b4ee36</hash>
        <iocs>
          <urls>
            <value>
              <url>https://discord.gg/KTmVDss</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>discord.gg</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>162.159.135.234</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>16.8.1.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a</SHA-256>
              <SHA-1>cac699787884fb993ced8d7dc47b7c522c7bc734</SHA-1>
              <MD5>b7db84991f23a680df8e95af8946f9c9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>576da2aa9135e640f9a50fbe9dc2bd87bda11f589ca041b20a0d32f53710a384</SHA-256>
              <SHA-1>6a3aa816af8c9cbea226dcca1910d0cc42437c4d</SHA-1>
              <MD5>c45343b04e421b46a37b11dbf2fb72c7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>a14e70ed824f3f17d3a51136aa08839954d6d3ccadaa067415c7bfc08e6636b0</SHA-256>
              <SHA-1>0b40150c95fc2c6414c90d44ee78b8d8814b3393</SHA-1>
              <MD5>3c68f77c35c26ff079a1c410ee44fa62</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>b26f5c52da74916898b6f44179fd10761cddb96fb58c34464f4344daf9e2c17a</SHA-256>
              <SHA-1>f0540042636d62be9b04fa40368207f5da3d163a</SHA-1>
              <MD5>31fed487a9e6ceab705fff4893617d4b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>f38d06373da95be1523128b895fb6dc5f251f66133857ea69a193657f6cacf1a</SHA-256>
              <SHA-1>8e48977631708c5b725abf750db7f6afebcc97a4</SHA-1>
              <MD5>bc1857c3496f563448b853497c8ae7a3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>ad228357486fe6251d8d77f1de23545c5c6ca7446bc86730e54c824fd5ba6621</SHA-256>
              <SHA-1>11db4e806424352ed4bc46cc083ff93a030600c7</SHA-1>
              <MD5>fe82f3ae26c92a61cbcd3e5bd7422a16</MD5>
              <origin>DOTNET_RESOURCES</origin>
              <file_type>application/x-font-ttf</file_type>
            </value>
            <value>
              <SHA-256>3408983cbb32c316f518bba4c59717237a10b6e3c16834b831604ceb2fe33615</SHA-256>
              <SHA-1>07acccfb228ec60d242b83ad5f68eb9ec11f6801</SHA-1>
              <MD5>28140a52f66ab05495d95b19f429c2ed</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>83180ffc-a740-497e-a33f-e58940318a36</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>Discord Auto Typer.exe</name>
        <report_id>c0c3c1fb-8938-43d5-ae4d-5d1ba46d5dc6</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>dotnet_pe</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e3df8e96cc39fd7afed29d5f7c46198d612c63e8c922a6c170447576947f2012</id>
    <title>Analysis Report for e3df8e96cc39fd7afed29d5f7c46198d612c63e8c922a6c170447576947f2012</title>
    <updated>2026-08-20T21:35:26Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877325f2677ae4d366d59f</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6a87731c0dfb99c1ceb09057</flow_id>
        <hash>e3df8e96cc39fd7afed29d5f7c46198d612c63e8c922a6c170447576947f2012</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>4998a3d477034cd7ad0faf1bf30da8a00b759e8caf67d93ebbc86d21f6c3c5fa</SHA-256>
              <SHA-1>3eacbd84abd73b01f94afc89375a431f39c64f74</SHA-1>
              <MD5>c3521136bb9ddfa0fc8fe938ede2aed7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>MysteryMonkey0.001.dll</name>
        <report_id>eccfdf89-96b6-43bb-be29-1ad5309e61a2</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>dotnet_pe</value>
        </tags>
        <verdict>UNKNOWN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f7223a2dd6a1e31d374df80194f141ef33428d757a33bcbecc6b04335d830399</id>
    <title>Analysis Report for f7223a2dd6a1e31d374df80194f141ef33428d757a33bcbecc6b04335d830399</title>
    <updated>2026-08-20T21:35:17Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87737ef2677ae4d366d5ba</_id>
        <file_type>text/x-shellscript</file_type>
        <flow_id>6a8773140dfb99c1ceb0903e</flow_id>
        <hash>f7223a2dd6a1e31d374df80194f141ef33428d757a33bcbecc6b04335d830399</hash>
        <iocs>
          <urls>
            <value>
              <url>http://5.182.210.174/1294b8</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://5.182.210.174/370ef8</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://5.182.210.174/597d4b</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://5.182.210.174/5a848f</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://5.182.210.174/7202b4</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://5.182.210.174/797dff</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://5.182.210.174/85a4f4</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://5.182.210.174/8a90f5</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://5.182.210.174/b4af73</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://5.182.210.174/c060bd</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>http://5.182.210.174/e04f45</url>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </urls>
          <ips>
            <value>
              <ip>5.182.210.174</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
        </iocs>
        <name>ok.sh</name>
        <report_id>171b0c02-ed7e-435f-a68e-5f8398a5ff9e</report_id>
        <tags>
          <value>shell</value>
          <value>mirai</value>
          <value>evasive</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ab0439b8f407ad147339bfe24e3d7fb787a2351976c7f6f037cbe86e8f4d5cdb</id>
    <title>Analysis Report for ab0439b8f407ad147339bfe24e3d7fb787a2351976c7f6f037cbe86e8f4d5cdb</title>
    <updated>2026-08-20T21:34:37Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877306f2677ae4d366d595</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8772edf72d6ce80a272d79</flow_id>
        <hash>ab0439b8f407ad147339bfe24e3d7fb787a2351976c7f6f037cbe86e8f4d5cdb</hash>
        <iocs>
          <urls>
            <value>
              <url>https://fonts.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&amp;display=swap&amp;cb=yqgrhgd8</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&amp;display=swap&amp;cb=yqgrhgd8</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://invite.summit-event.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://invite.summit-event.com/#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://invite.summit-event.com/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://invite.summit-event.com/k2ikWozn05ixc/964193e4f6af3.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://invite.summit-event.com/k2ikWozn05ixc/chunk-28590baa0c5.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://invite.summit-event.com/k2ikWozn05ixc/chunk-54d442b69.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://invite.summit-event.com/k2ikWozn05ixc/e4eb96f177920e139.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://invite.summit-event.com/k2ikWozn05ixc/ef664c28d1d.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://invite.summit-event.com/k2ikWozn05ixc/lazy-5590b6f3.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://invite.summit-event.com/k2ikWozn05ixc/module.5f23654.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://invite.summit-event.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>invite.summit-event.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>100.48.80.34</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.110.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.14.94</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>c3d736d3f08e992dd4fbeecc86eab2a369a66fe6069a0b3dd4100736fe064d3f</SHA-256>
              <SHA-1>21d8e5ca89c41ba72559ad1001cb255417a89dd1</SHA-1>
              <MD5>5a4e18b1d9ff8c89fd3b2e7e43b5f5ab</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/css</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://invite.summit-event.com/</name>
        <report_id>da38e917-7494-469d-b209-23948add5d07</report_id>
        <tags>
          <value>html</value>
          <value>txt</value>
          <value>captcha</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0a32b2b04d23a7b86eb5364449001aa5255b798f9465f5531701e10f568a8b48</id>
    <title>Analysis Report for 0a32b2b04d23a7b86eb5364449001aa5255b798f9465f5531701e10f568a8b48</title>
    <updated>2026-08-20T21:34:26Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8772edf2677ae4d366d58e</_id>
        <file_type>application/x-ms-shortcut</file_type>
        <flow_id>6a8772e0f72d6ce80a272d5c</flow_id>
        <hash>0a32b2b04d23a7b86eb5364449001aa5255b798f9465f5531701e10f568a8b48</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.documentfoundation.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>documentfoundation.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>65.109.131.19</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>7a6b604834c1c98301921ae4348ce2318d80f3b19806bd41bbe0e58be8ad3228</SHA-256>
              <SHA-1>8f7ca5cab1cb5dc702fc49939aaacf7585c9f515</SHA-1>
              <MD5>b3c248b8769f5b1f5edf086ac2a8c0f9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>00021401-0000-0000-C000-000000000046</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>LibreOffice 26.2.lnk</name>
        <report_id>d8d859cb-5f41-448c-959a-d48dc538553c</report_id>
        <tags>
          <value>lnk</value>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>3fa5ca3eedb5d31147c54c9a2d43f8c52eea4ad92b3078165c1b0b60492e7715</id>
    <title>Analysis Report for 3fa5ca3eedb5d31147c54c9a2d43f8c52eea4ad92b3078165c1b0b60492e7715</title>
    <updated>2026-08-20T21:30:42Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8772acf2677ae4d366d57c</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8772005a70bef4cd151628</flow_id>
        <hash>3fa5ca3eedb5d31147c54c9a2d43f8c52eea4ad92b3078165c1b0b60492e7715</hash>
        <iocs>
          <urls>
            <value>
              <url>https://alcdn.msauth.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://alcdn.msauth.net/browser/2.30.0/js/msal-browser.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://app.vectary.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://browser.sentry-cdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/goengineer_number-1_technical_support_and_resource.jpg</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://centralus-0.in.applicationinsights.azure.com/;LiveEndpoint=https://centralus.livediagnostics.monitor.azure.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://community.goengineer.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://connect.facebook.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://connect.facebook.net/en_US/fbevents.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.com/assets/external/E-v1.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fast.wistia.com/embed/medias/u9cwa4eesa.jsonp</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://form-embed-sdk.goldcast.io/embed.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://forms.hsforms.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://go.microsoft.com/fwlink/?linkid=2128109%5CnHost:</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://js.hsforms.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://js.hsforms.net/forms/v2.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://js.monitor.azure.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://js.monitor.azure.com/scripts/b/ai.3.gbl.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://kit.fontawesome.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://my.goengineer.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://snap.licdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://snap.licdn.com/li.lms-analytics/insight.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://static.elfsight.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://stgoengmedialibraryprod.blob.core.windows.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://stgoengmedialibraryprod.blob.core.windows.net/styles/Production/hubspot.js?v=106538097</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/3d-printers</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/3d-scanning</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/3d-scanning?product_type1=Accessories</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/3d-scanning?product_type1=Targets</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/materials-consumables?product_type1=Consumables</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/materials-consumables?product_type1=Materials</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/materials-consumables?product_type1=Materials&amp;select_a_vendor=Formlabs</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/pages/consumable-price-lists</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.clarity.ms</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.clarity.ms/tag/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.facebook.com/goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.goengineer.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.goengineer.com/3d-printing/formlabs?category=sls#3dprinters</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/en-us/support</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/fr-ca/support</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/images/goengineer_inline.png</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.goengineer.com/schedule-application-mentoring-session</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/sitemap.xml</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/support</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/support#breadcrumbs</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.goengineer.com/support#service</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.goengineer.com/support#webpage</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.microsoft.com/en-us/edge</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.socialintents.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.tiktok.com/@goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.youtube.com/@goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/@goengineer/?sub_confirmation=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/goengineer/?sub_confirmation=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://x.com/goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/support</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>alcdn.msauth.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>app.vectary.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>browser.sentry-cdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>cdn.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>centralus-0.in.applicationinsights.azure.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>community.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>connect.facebook.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>fast.wistia.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>form-embed-sdk.goldcast.io</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>forms.hsforms.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>go.microsoft.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>js.hsforms.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>js.monitor.azure.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>kit.fontawesome.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>my.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>snap.licdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>static.elfsight.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>stgoengmedialibraryprod.blob.core.windows.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>store.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.clarity.ms</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.instagram.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.microsoft.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.socialintents.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.tiktok.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>x.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>info@goengineer.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>support@goengineer.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>172.66.1.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>95.100.102.9</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.19.175.188</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.60.241.1</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.40.68</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>146.75.122.132</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.16.6.65</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.227.38.74</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>151.101.66.217</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>13.107.246.45</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.20.33.75</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.40.202.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.118.198.34</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>57.144.244.128</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.55.161.151</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>54.246.129.210</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>52.222.214.78</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.40.202.9</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>df777bc14a76c1cee05edf27b7cbc1da95216202d7963f6930bf35e8a239b2aa</SHA-256>
              <SHA-1>0f355083b967214156df90bf9898d6b8bf606286</SHA-1>
              <MD5>0fbb415b167329aed53b3fe4570119f9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>220bcb1ca2a00dad8195df3f900f82cab60fa423364e9d9aff31559947bf15ce</SHA-256>
              <SHA-1>8d52cf5d7815d3679d1cd8f326471edfe9fd9f34</SHA-1>
              <MD5>4ddcdb6a2d207dd0277856f0549bcf60</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>3ef42e6ba98c2f20d4d3d724839be4aea7718e258d5c4ef49e0da712080cdf1b</SHA-256>
              <SHA-1>94ef6984ae37096fe0c31d76bbbc01983a359cfa</SHA-1>
              <MD5>34560fdbea151cc64b163987cf52c41d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/jpeg</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>ca76f379e6093d111c43a6857a55f9b0e668aa116df8bcaeba6a84721214bd7d</SHA-256>
              <SHA-1>8604cd4694423b80a1b3f0831dbff06841fcba5a</SHA-1>
              <MD5>01969dd994f026944c63a04eeae93f8a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>af0745562f1d597413e728a7ddaf2513e7385c4fa3a1ad800e8aa70128aad4cc</SHA-256>
              <SHA-1>22d427548ae0a71f53b7efe72b812de7602c8a1f</SHA-1>
              <MD5>fadec08d43ff0a9cd897d76c304495db</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>99409bd3c588811a8f46e818475f0db05839e03a9361ad1081301800ac251a87</SHA-256>
              <SHA-1>e50a43868c6ce604323a70ee7a2b50ab9a7c03ec</SHA-1>
              <MD5>af43af9c06085f08a7910a9c2d81fd64</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>b1ee5f0cd4a468041bae848f0eb4748e82cbff97c7cad5b3e469bc47b5986902</SHA-256>
              <SHA-1>1a2cc8c6aae8517083510c0f6cc20c8754e9b8f5</SHA-1>
              <MD5>71d15d1c8e1608b19454de6e55368cf9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>3e63dc9c-4554-4d61-9ad3-bdf58b7d6368</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>82a00e25-92f3-4d23-8909-b52e24ed9692</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://www.goengineer.com/support</name>
        <report_id>d441529f-8530-46f6-8fd8-1cc161bbff76</report_id>
        <tags>
          <value>html</value>
          <value>jpg</value>
          <value>javascript</value>
          <value>anti-vm</value>
          <value>obfuscated</value>
          <value>base64</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f3c50be0bda1a6a7e0b3b5e9f89058cfa7c7c6319c330cb01eb701f31d55582c</id>
    <title>Analysis Report for f3c50be0bda1a6a7e0b3b5e9f89058cfa7c7c6319c330cb01eb701f31d55582c</title>
    <updated>2026-08-20T21:30:42Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8772a8f2677ae4d366d579</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8772000dfb99c1ceb08be8</flow_id>
        <hash>f3c50be0bda1a6a7e0b3b5e9f89058cfa7c7c6319c330cb01eb701f31d55582c</hash>
        <iocs>
          <urls>
            <value>
              <url>https://aadcdn.msftauthimages.net/dbd5a2dd-zphu-buwibp7x0uppjby9eumv1ujwyby6ubldwl3you/logintenantbranding/0/bannerlogo?ts=637449430676588345</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://aadcdn.msftauthimages.net/dbd5a2dd-zphu-buwibp7x0uppjby9eumv1ujwyby6ubldwl3you/logintenantbranding/0/illustration?ts=637496945398050520</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://handlebarsjs.com/api-reference/runtime-options.html#options-to-control-prototype-access</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://mygoengineer.b2clogin.com/static</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://mygoengineer.b2clogin.com/static/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://stgoengssoprod.blob.core.windows.net/sso/mfa/login.html</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://my.goengineer.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>aadcdn.msftauthimages.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>handlebarsjs.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mygoengineer.b2clogin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>stgoengssoprod.blob.core.windows.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>13.107.246.45</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.199.109.153</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.190.160.22</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>57.150.134.33</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>8472645532dbf0bdd80f112ae763410477f6f7e7a7c7cb0aa611ba6d3e7acdf5</SHA-256>
              <SHA-1>c8d9a30b3c4dcb121bee4c04a583c24d8b5602b8</SHA-1>
              <MD5>ad2260161dda90be9a5b50a3866ca8e2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>930e5ad03fa9c984b635ba75b135052e4f1eafdaa9c61cb0b026c5b3c649f3dd</SHA-256>
              <SHA-1>1e133798f76c1b92f0bc90b450c48f7e96fa9f7b</SHA-1>
              <MD5>24a1c09e782a281643493e22ca4802be</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/jpeg</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>c55a389482d0d05c25517f9f0bd8a43d792cb688b449bc6299bcdc3570c6bb5a</SHA-256>
              <SHA-1>b8f4526ac1f3e6ade065f9b9b66b4a1a21ac22a1</SHA-1>
              <MD5>d06e3ab97e47bfdcad3f9ed0f4fa105f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>c54008cfaffe2e6442ed8bfedc1c3511572980a7af2796ff3a76fedd5d4d1fba</SHA-256>
              <SHA-1>f49ca8c8e488208e56c5551db3ec9fac93f4ed46</SHA-1>
              <MD5>97a729425160429efb6b9ec91f1c7a96</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>13b2b08dedfbb30694003c4d17c8f260205dc6d9c50c9cb6e57e91d9b705c3d6</SHA-256>
              <SHA-1>e81e45a9fe8b50c6b392541b4aa9d50733f19fda</SHA-1>
              <MD5>63cbb6bb9216249325401ee15cf4a437</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>241d7c35-bfb2-4bf8-ab4e-09816659fc2f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>c10d9537-83ca-4831-a9ef-ef40c75a62c1</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://my.goengineer.com/</name>
        <report_id>07c08a77-7ccb-4af5-9cc9-9fbffedb1ec1</report_id>
        <tags>
          <value>html</value>
          <value>jpg</value>
          <value>png</value>
          <value>txt</value>
          <value>obfuscated</value>
          <value>base64</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>c4a42c98ca7fc05c75c27254d770076ceb50440a8a18cd2eca3cf8e321b551a7</id>
    <title>Analysis Report for c4a42c98ca7fc05c75c27254d770076ceb50440a8a18cd2eca3cf8e321b551a7</title>
    <updated>2026-08-20T21:30:42Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8772aaf2677ae4d366d57a</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877200f72d6ce80a272b2c</flow_id>
        <hash>c4a42c98ca7fc05c75c27254d770076ceb50440a8a18cd2eca3cf8e321b551a7</hash>
        <iocs>
          <urls>
            <value>
              <url>https://alcdn.msauth.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://alcdn.msauth.net/browser/2.30.0/js/msal-browser.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://app.vectary.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://browser.sentry-cdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/formlabs-fusex1-promo-bannerBACKGROUND.png?languageIso=en-us&amp;format=webp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://centralus-0.in.applicationinsights.azure.com/;LiveEndpoint=https://centralus.livediagnostics.monitor.azure.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://community.goengineer.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://connect.facebook.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://connect.facebook.net/en_US/fbevents.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.com/assets/external/E-v1.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fast.wistia.com/embed/medias/0fk828zbj5/swatch</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.com/embed/medias/u9cwa4eesa.jsonp</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://form-embed-sdk.goldcast.io/embed.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://forms.hsforms.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://go.microsoft.com/fwlink/?linkid=2128109%5CnHost:</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://js.hsforms.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://js.hsforms.net/forms/v2.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://js.monitor.azure.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://js.monitor.azure.com/scripts/b/ai.3.gbl.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://kit.fontawesome.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://my.goengineer.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://snap.licdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://snap.licdn.com/li.lms-analytics/insight.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://static.elfsight.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://stgoengmedialibraryprod.blob.core.windows.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://stgoengmedialibraryprod.blob.core.windows.net/styles/Production/hubspot.js?v=106538097</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/3d-printers</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/3d-scanning</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/3d-scanning?product_type1=Accessories</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/3d-scanning?product_type1=Targets</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/materials-consumables?product_type1=Consumables</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/materials-consumables?product_type1=Materials</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/materials-consumables?product_type1=Materials&amp;select_a_vendor=Formlabs</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/pages/consumable-price-lists</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.clarity.ms</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.clarity.ms/tag/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.facebook.com/goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/goengineer/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.goengineer.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/#logo</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.goengineer.com/#organization</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.goengineer.com/#website</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.goengineer.com/3d-printing/formlabs?category=sls#3dprinters</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/en-us/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/fr-ca/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/images/goengineer_inline.png</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.goengineer.com/index</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.goengineer.com/index#webpage</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.goengineer.com/schedule-application-mentoring-session</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/search?q=%7Bsearch_term_string%7D</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.goengineer.com/sitemap.xml</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/goengineer/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/goengineer/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.microsoft.com/en-us/edge</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.socialintents.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.tiktok.com/@goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.youtube.com/@goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/@goengineer/?sub_confirmation=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/channel/UCAimmACAI93EHFbCoj29FJw</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/goengineer/?sub_confirmation=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://x.com/goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>alcdn.msauth.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>app.vectary.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>browser.sentry-cdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>cdn.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>centralus-0.in.applicationinsights.azure.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>community.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>connect.facebook.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>fast.wistia.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>form-embed-sdk.goldcast.io</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>forms.hsforms.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>go.microsoft.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>js.hsforms.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>js.monitor.azure.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>kit.fontawesome.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>my.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>snap.licdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>static.elfsight.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>stgoengmedialibraryprod.blob.core.windows.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>store.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.clarity.ms</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.instagram.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.microsoft.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.socialintents.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.tiktok.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>x.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>info@goengineer.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>support@goengineer.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>172.66.1.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>95.100.102.9</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>54.246.129.210</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>151.101.66.217</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.40.68</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.118.198.34</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>146.75.122.132</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>52.222.214.78</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.20.33.75</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.16.6.65</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>13.107.246.45</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.40.202.9</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.60.241.1</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>57.144.244.128</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.40.202.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.55.161.151</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.19.175.188</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.227.38.74</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>e31a4016d93d702fb15ac649afebd5684d7c0e3f6e6d5baa9d1cffd5dfd548bb</SHA-256>
              <SHA-1>fcc194de4a9fc4b962a55bd9dbf967d3ebfbf78f</SHA-1>
              <MD5>8f8a2e4724239f9ee8e054431d0ef6a1</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/jpeg</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>220bcb1ca2a00dad8195df3f900f82cab60fa423364e9d9aff31559947bf15ce</SHA-256>
              <SHA-1>8d52cf5d7815d3679d1cd8f326471edfe9fd9f34</SHA-1>
              <MD5>4ddcdb6a2d207dd0277856f0549bcf60</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>e3bcdbd3f8e6910b1896c86be0058972fd9d9fcfe68d7bb78b76bfacc6024a7c</SHA-256>
              <SHA-1>bf5573f7e154895699d374e9ef9894ca4a6af3a6</SHA-1>
              <MD5>d28f6aa5d817d39f53f5d9d115ccca9c</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>ca76f379e6093d111c43a6857a55f9b0e668aa116df8bcaeba6a84721214bd7d</SHA-256>
              <SHA-1>8604cd4694423b80a1b3f0831dbff06841fcba5a</SHA-1>
              <MD5>01969dd994f026944c63a04eeae93f8a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>eb2c8e157bf537644c0bad84c748dcddb53837c2bf672771167b0152dba8776a</SHA-256>
              <SHA-1>3c7c75735a81dba3982176159c2322f067c98adf</SHA-1>
              <MD5>e44dfafaac11ff714322bc6fe6bedd2a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>af0745562f1d597413e728a7ddaf2513e7385c4fa3a1ad800e8aa70128aad4cc</SHA-256>
              <SHA-1>22d427548ae0a71f53b7efe72b812de7602c8a1f</SHA-1>
              <MD5>fadec08d43ff0a9cd897d76c304495db</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>99409bd3c588811a8f46e818475f0db05839e03a9361ad1081301800ac251a87</SHA-256>
              <SHA-1>e50a43868c6ce604323a70ee7a2b50ab9a7c03ec</SHA-1>
              <MD5>af43af9c06085f08a7910a9c2d81fd64</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>b1ee5f0cd4a468041bae848f0eb4748e82cbff97c7cad5b3e469bc47b5986902</SHA-256>
              <SHA-1>1a2cc8c6aae8517083510c0f6cc20c8754e9b8f5</SHA-1>
              <MD5>71d15d1c8e1608b19454de6e55368cf9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>3e63dc9c-4554-4d61-9ad3-bdf58b7d6368</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>59ba93d6-f8f1-4b4e-b074-85d9804ff948</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>82a00e25-92f3-4d23-8909-b52e24ed9692</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://www.goengineer.com/</name>
        <report_id>0fcb7bc8-6f67-47d6-a742-bd2ea2a45c4b</report_id>
        <tags>
          <value>html</value>
          <value>jpg</value>
          <value>javascript</value>
          <value>anti-vm</value>
          <value>obfuscated</value>
          <value>base64</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>154964a2abac2346fc93fd96464abcad1fb3c3d6a37edf26d8f6db26662812ef</id>
    <title>Analysis Report for 154964a2abac2346fc93fd96464abcad1fb3c3d6a37edf26d8f6db26662812ef</title>
    <updated>2026-08-20T21:30:42Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877285f2677ae4d366d56f</_id>
        <file_type>text/html</file_type>
        <flow_id>6a87720067502b6ca997ad35</flow_id>
        <hash>154964a2abac2346fc93fd96464abcad1fb3c3d6a37edf26d8f6db26662812ef</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.goengineer.com/blog</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://alcdn.msauth.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://alcdn.msauth.net/browser/2.30.0/js/msal-browser.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://app.vectary.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://browser.sentry-cdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://centralus-0.in.applicationinsights.azure.com/;LiveEndpoint=https://centralus.livediagnostics.monitor.azure.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://community.goengineer.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://connect.facebook.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://connect.facebook.net/en_US/fbevents.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.com/assets/external/E-v1.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fast.wistia.com/embed/medias/u9cwa4eesa.jsonp</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://form-embed-sdk.goldcast.io/embed.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://forms.hsforms.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://go.microsoft.com/fwlink/?linkid=2128109%5CnHost:</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://js.hsforms.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://js.hsforms.net/forms/v2.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://js.monitor.azure.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://js.monitor.azure.com/scripts/b/ai.3.gbl.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://kit.fontawesome.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://my.goengineer.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://snap.licdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://snap.licdn.com/li.lms-analytics/insight.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://static.elfsight.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://stgoengmedialibraryprod.blob.core.windows.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://stgoengmedialibraryprod.blob.core.windows.net/styles/Production/hubspot.js?v=106538097</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/3d-printers</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/3d-scanning</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/3d-scanning?product_type1=Accessories</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/3d-scanning?product_type1=Targets</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/materials-consumables?product_type1=Consumables</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/materials-consumables?product_type1=Materials</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/materials-consumables?product_type1=Materials&amp;select_a_vendor=Formlabs</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/pages/consumable-price-lists</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.clarity.ms</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.clarity.ms/tag/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.facebook.com/goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/3d-printing/formlabs?category=sls#3dprinters</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/ai-in-solidworks</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/comparing-solidworks-packages</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/create-a-spring-that-will-expand-and-compress-in-a-solidworks-assembly</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/how-canadian-tier-2-and-tier-3-suppliers-can-secure-contracts-under-2-billion-dollar-gdls-expansion</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/how-to-install-solidworks-flow-simulation-remote-solver</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/intelligence-before-the-ai-hype-how-solidworks-has-guided-design-for-years</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/rename-groups-in-driveworks</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/resolve-err-files-when-saving-step-files-in-solidworks</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/using-ground-planes-in-solidworks-visualize</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/schedule-application-mentoring-session</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/sitemap.xml</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.microsoft.com/en-us/edge</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.socialintents.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.tiktok.com/@goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.youtube.com/@goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.youtube.com/@goengineer/?sub_confirmation=1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.youtube.com/goengineer/?sub_confirmation=1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://x.com/goengineer</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://alcdn.msauth.net/browser/2.30.0/js/msal-browser.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://browser.sentry-cdn.com/9.6.1/bundle.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/3d-printing-support-menu.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/3dexperience-menu-logo.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/application-mentoring-session-menu.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/blog_listing_banner.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/camworks-menu-logo.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/catia-menu-logo.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/certified-solidworks-associate-cswa-badge-menu.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/certified-solidworks-expert-cswe-badge-menu.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/certified-solidworks-professional-cswp-badge-menu.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/create-spring-expand-compress-solidworks-assembly.png?languageIso=en-us&amp;v=639220787491729598</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/custom-appearances-with-shadow-catchers-solidworks-visualize.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/driveworks-menu-navigation.png?languageIso=en-us&amp;format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/dyemansion-menu-logo.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/goengineer-blog-menu.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/goengineer-community-blog-ad.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/goengineer-community-forum-icon.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/goengineer-contact-us-menu.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/goengineer-customer-portal-menu-logo.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/goengineer-menu-logo.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/goengineer-office-locations-us-canada.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/goengineer-resources-search-menu.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/goengineer-services-menu-logo.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/goengineer-software-support-menu.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/goengineer-upcoming-event-calendar.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/goengineer-upcoming-webinar-calendar.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/goengineer-video-library-menu.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/goengineer-webinars-menu-logo.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/goengineer-youtube-menu-logo.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/how-canadian-tier-2-tier-3-suppliers-can-secure-contracts-under-the-2b-gdls-expansion.png?getSourceVideo=False&amp;languageIso=en-us</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/iso_9001-2015_logo_100px.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/onulis-menu-logo.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/oryx-menu-logo.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/postprocess-menu-logo.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/rename-driveworks-groups-thumbnail.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/resolve-err-files-when-saving-step-files-in-solidworks.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/simulia-menu-logo.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/solidworks-design-premium-leo-ai-assistant.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/solidworks-draftxpert.png?languageIso=en-us&amp;v=638959869059560861</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/solidworks-flow-simulation-heat-exchanger-model.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/solidworks-menu-logo.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/solidworks-standard-vs-professional.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.goengineer.com/solidworks-user-groups-badge.png?format=webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://centralus-0.in.applicationinsights.azure.com/v2/track</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fast.wistia.com/assets/external/E-v1.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fast.wistia.com/embed/medias/u9cwa4eesa.jsonp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Open%20Sans:wght@400;500;700&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://form-embed-sdk.goldcast.io/embed.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&amp;count=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&amp;count=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://forms.hsforms.com/embed/v3/form/9019067/3e63dc9c-4554-4d61-9ad3-bdf58b7d6368/json?hs_static_app=forms-embed&amp;hs_static_app_version=1.11273&amp;X-HubSpot-Static-App-Info=forms-embed-1.11273</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.hsforms.net/forms/v2.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js.monitor.azure.com/scripts/b/ai.3.gbl.min.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://js.monitor.azure.com/scripts/b/ai.config.1.cfg.json</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://ka-p.fontawesome.com/releases/v6.7.2/css/pro-v4-font-face.min.css?token=07a6464f1c</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ka-p.fontawesome.com/releases/v6.7.2/css/pro-v4-shims.min.css?token=07a6464f1c</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ka-p.fontawesome.com/releases/v6.7.2/css/pro-v5-font-face.min.css?token=07a6464f1c</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ka-p.fontawesome.com/releases/v6.7.2/css/pro.min.css?token=07a6464f1c</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ka-p.fontawesome.com/releases/v6.7.2/webfonts/pro-fa-brands-400-0.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ka-p.fontawesome.com/releases/v6.7.2/webfonts/pro-fa-brands-400-2.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ka-p.fontawesome.com/releases/v6.7.2/webfonts/pro-fa-solid-900-0.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ka-p.fontawesome.com/releases/v6.7.2/webfonts/pro-fa-solid-900-12.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://kit.fontawesome.com/07a6464f1c.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://kit.fontawesome.com/07a6464f1c/20813561/kit-upload.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://my.goengineer.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://stgoengmedialibraryprod.blob.core.windows.net/styles/Production/hubspot.js?v=106538097</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/3d-printers</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/3d-scanning</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/3d-scanning?product_type1=Accessories</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/3d-scanning?product_type1=Targets</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/materials-consumables?product_type1=Consumables</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/materials-consumables?product_type1=Materials</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/collections/materials-consumables?product_type1=Materials&amp;select_a_vendor=Formlabs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://store.goengineer.com/pages/consumable-price-lists</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/goengineer</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/3d-printing/formlabs?category=sls#3dprinters</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/ai-in-solidworks</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/comparing-solidworks-packages</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/create-a-spring-that-will-expand-and-compress-in-a-solidworks-assembly</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/how-canadian-tier-2-and-tier-3-suppliers-can-secure-contracts-under-2-billion-dollar-gdls-expansion</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/how-to-install-solidworks-flow-simulation-remote-solver</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/intelligence-before-the-ai-hype-how-solidworks-has-guided-design-for-years</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/rename-groups-in-driveworks</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/resolve-err-files-when-saving-step-files-in-solidworks</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/blog/using-ground-planes-in-solidworks-visualize</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/css/cookie-consent.css?v=jqx_vc7PDBVlxGMa5aoHJ_Z2EKUx__DpMxUAw1bCTo4</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/css/dist/bebasneue-bold.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/css/dist/bundle.min.css?v=1n8QO4wKAxbUIABCqkUzksV3xhmqlbkiChcwHFx6GRo</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/css/dist/opensans-bold.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/css/dist/opensans-italic.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/css/dist/opensans-regular.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/css/dist/opensans-semibold.ttf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/css/flag-icons.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/favicon.ico?v=u9TE5dn0nenGjfoK7LvsZcl1-y52PzKxRYL6WnvLfNA</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/images/goengineer_logo.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/js/admin/ge-pagination.js?v=6hBp4XELthf4YQji_bSl906bdo9vTwZ1SXSkEBsw1B0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/js/blog/index.js?v=moyY5J3z6kep_PyRYP-Vr3Fc_wt8VtFeTvlNEfyaCWs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/js/bundle-core.min.js?v=xvOgqtoPw3f-wQ1EH3prc_eHgXe7EWlF1rT2M4I5u1Y</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/js/bundle-deferred.min.js?v=Xmmw4mhjN7BeMW2ZovmDcLDeFyjRf_5gwLsWqcKVe6Y</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/js/cms-deferred-activator.js?v=_AS_od8WNj6EB-7Wu1BpWS5wRVic4kB2hrGzX1-es50</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/js/cookie-consent.js?v=CkufrNEeM9zwwz-ucRfmwHlLkVqUjJSiBUlN7x6BbwE</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/navigation/assets/css?v=2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/navigation/assets/js?v=2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/navigation/mega-menu?culture=en-us</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/schedule-application-mentoring-session</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/sitemap.xml</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/uploads/css/base.css?v=20240409</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/uploads/css/footer.css?v=20240409</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/uploads/css/navigation.css?v=20240409.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/goengineer</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/goengineer</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.microsoft.com/en-us/edge</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.tiktok.com/@goengineer</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.youtube.com/@goengineer</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/@goengineer/?sub_confirmation=1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/goengineer/?sub_confirmation=1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://x.com/goengineer</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:info@goengineer.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:support@goengineer.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>alcdn.msauth.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>app.vectary.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>browser.sentry-cdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>cdn.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>centralus-0.in.applicationinsights.azure.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>community.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>connect.facebook.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>fast.wistia.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>form-embed-sdk.goldcast.io</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>forms.hsforms.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>go.microsoft.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>js.hsforms.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>js.monitor.azure.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>kit.fontawesome.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>my.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>snap.licdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>static.elfsight.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>stgoengmedialibraryprod.blob.core.windows.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>store.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.clarity.ms</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.goengineer.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.instagram.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.microsoft.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.socialintents.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.tiktok.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>x.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>alcdn.msauth.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>browser.sentry-cdn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cdn.goengineer.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>centralus-0.in.applicationinsights.azure.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>community.goengineer.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fast.wistia.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>form-embed-sdk.goldcast.io</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>forms-na1.hsforms.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>forms.hsforms.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>js.hsforms.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>js.monitor.azure.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>ka-p.fontawesome.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>kit.fontawesome.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>my.goengineer.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>stgoengmedialibraryprod.blob.core.windows.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>store.goengineer.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.goengineer.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.instagram.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.microsoft.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.tiktok.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.youtube.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>x.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>info@goengineer.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>support@goengineer.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>20.40.202.9</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>52.222.214.64</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.40.68</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.40.202.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.227.38.74</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.66.174.217</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>146.75.122.132</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.250.198.32</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>162.159.141.105</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.16.6.65</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>13.107.246.45</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.80.204</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.55.161.151</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>57.144.244.128</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>95.100.102.9</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.118.198.34</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>34.252.229.146</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>20.60.241.1</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>151.101.2.217</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.16.6.65</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.80.204</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.19.175.188</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.107.246.45</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.250.154.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.250.154.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>146.75.122.132</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>151.101.194.217</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>172.64.147.188</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>20.118.198.34</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>20.118.56.3</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>20.209.37.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>20.40.202.11</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>52.222.214.64</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>f484fe9af96854bdfb75ef615fe7623891a729403b9c7c0ed38767cdfe084be7</SHA-256>
              <SHA-1>dda40b5f0c212578b7846947ada57082e8cd9607</SHA-1>
              <MD5>f24da5a2de16670d4d9d74c583c0c01e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>e8f2ded5d74c0ee5f427a20b6715e65bc79ed5c4fc67fb00d89005515c8efe63</SHA-256>
              <SHA-1>ae56ea57c52d1153cec33cef91cf935d2d3af14d</SHA-1>
              <MD5>fbe36eb2eecf1b90451a3a72701e49d2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>cca39cd963daf7ae06f0f91d34b8f7b190c7402468e2fb9134aab79672a274a5</SHA-256>
              <SHA-1>fa8cadf2c0b4e3dc0391ec39895815bce677677f</SHA-1>
              <MD5>d496ddd2276cbe7c5e1bbe8c490ba38f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>99409bd3c588811a8f46e818475f0db05839e03a9361ad1081301800ac251a87</SHA-256>
              <SHA-1>e50a43868c6ce604323a70ee7a2b50ab9a7c03ec</SHA-1>
              <MD5>af43af9c06085f08a7910a9c2d81fd64</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>b1ee5f0cd4a468041bae848f0eb4748e82cbff97c7cad5b3e469bc47b5986902</SHA-256>
              <SHA-1>1a2cc8c6aae8517083510c0f6cc20c8754e9b8f5</SHA-1>
              <MD5>71d15d1c8e1608b19454de6e55368cf9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <SHA-256>af0745562f1d597413e728a7ddaf2513e7385c4fa3a1ad800e8aa70128aad4cc</SHA-256>
              <SHA-1>22d427548ae0a71f53b7efe72b812de7602c8a1f</SHA-1>
              <MD5>fadec08d43ff0a9cd897d76c304495db</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>f2d7c79c766c9f290ff870be7844c33bd488485c2aae7cb69e33839864ec4bc0</SHA-256>
              <SHA-1>048f666de5b66b8353815af8c257d1833904e581</SHA-1>
              <MD5>4641ed70b19bf3304ffaa6cf69af40eb</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/javascript</file_type>
              <verdict>LIKELY_MALICIOUS</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>3e63dc9c-4554-4d61-9ad3-bdf58b7d6368</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>416ac92b-83fd-40c7-45ca-08d80bdded87</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>51c82779-5eda-4788-45c6-08d80bdded87</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>7c9971cf-cdcf-4f8b-432f-08daea8e189f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>82a00e25-92f3-4d23-8909-b52e24ed9692</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>88063fba-1233-448c-45cd-08d80bdded87</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>bd7a22f0-dfc2-4080-ce12-08d80cb05a9f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>c23acd0b-8c23-4af7-ce0f-08d80cb05a9f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://www.goengineer.com/blog</name>
        <report_id>b313cc48-14cc-46a0-8242-e6a417fd25ea</report_id>
        <tags>
          <value>html</value>
          <value>javascript</value>
          <value>anti-vm</value>
          <value>lolbin</value>
          <value>tracker</value>
          <value>obfuscated</value>
          <value>base64</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>66afbea29c4718d6af8c94b47bbc147e09e7b17e20b0b986d118b9ff0b5dcbe4</id>
    <title>Analysis Report for 66afbea29c4718d6af8c94b47bbc147e09e7b17e20b0b986d118b9ff0b5dcbe4</title>
    <updated>2026-08-20T21:30:42Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87720ef2677ae4d366d54e</_id>
        <file_type>image/png</file_type>
        <flow_id>6a8772009c770d0306f62af8</flow_id>
        <hash>66afbea29c4718d6af8c94b47bbc147e09e7b17e20b0b986d118b9ff0b5dcbe4</hash>
        <iocs>
          <urls>
            <value>
              <url>http://ns.adobe.com/illustrator/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/pdf/1.3</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/photoshop/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/g</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/mm</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/sType/Dimensions</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/sType/ResourceEvent</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/sType/ResourceRef</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0/t/pg</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/elements/1.1</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://cdn.goengineer.com/goengineer_logo_600.png</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>ns.adobe.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>purl.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>207.241.225.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <uuids>
            <value>
              <uuid>1e5acd00-a8bd-204c-a4f1-c0de26768d1c</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>6b368302-dd59-ce40-956c-40583be10ecd</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8d6bfb70-ceda-f04a-9349-a281e569d580</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>cb5e7bee-757f-5e43-8d7f-c4fa2cf5c767</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>cfb06c2f-ba1b-cf43-892e-878075eda97e</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://cdn.goengineer.com/goengineer_logo_600.png</name>
        <report_id>ca3ea8bf-fa09-4e6a-8a06-d4cf58e98646</report_id>
        <tags>
          <value>png</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>db634bbc390f73bd6a4e71bbc7defb4455ca35e43fabb8586034acad0d9bd8e8</id>
    <title>Analysis Report for db634bbc390f73bd6a4e71bbc7defb4455ca35e43fabb8586034acad0d9bd8e8</title>
    <updated>2026-08-20T21:30:42Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87721ef2677ae4d366d552</_id>
        <file_type>text/html</file_type>
        <flow_id>6a877200099a97c449ef479d</flow_id>
        <hash>db634bbc390f73bd6a4e71bbc7defb4455ca35e43fabb8586034acad0d9bd8e8</hash>
        <iocs>
          <urls>
            <value>
              <url>https://community.goengineer.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/#elNavTheme_menu</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/#ipsLayout_mainArea</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/applications/core/interface/font/fontawesome-webfont.woff2?v=4.7.0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/articles.html/articles/ai-in-solidworks-what-it-is-and-what-it-isn%E2%80%99t-r106/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/articles.html/articles/how-to-create-a-spring-that-will-expand-and-compress-in-a-solidworks-assembly-r107/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/aae2b9a1c261/0.6108743719353918:1787259916:5nlHOcwWgGBkpMExpNXHheNAOBhra5TaJGT4xdur5ig/a2e48041284f1917</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/aae2b9a1c261/main.js?</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/cdn-cgi/rum?</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/cdn-cgi/speculation</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/cf-fonts/s/bebas-neue/5.2.7/latin/400/normal.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/cf-fonts/v/open-sans/5.2.7/latin/wght/normal.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/cf-fonts/v/open-sans/5.2.7/symbols/wght/normal.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/contact/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/cookies/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/discover/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/events/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/files/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/forum/42-blog-posts/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/topic/8772-family-tables-with-hole-wizard/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/topic/8813-editing-separate-sheets-of-existing-sw-company-templates/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/topic/8839-editing-default-weldment-cut-list-table/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/topic/8841-search-forums-better/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/topic/8843-editing-appearance-in-sw2026/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/topic/8844-print-task-using-wrong-margins/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/topic/8845-design-table-swap-from-microsoft-office-to-google-suite/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/topic/8846-braket-assembly/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/topic/8850-turn-cutoff-feature-on-the-front/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/topic/8851-curve-driven-pattern/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/topic/8852-how-canadian-tier-2-tier-3-suppliers-can-secure-contracts-under-the-2b-gdls-expansion/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/topic/8853-intelligence-before-the-ai-hype-how-solidworks-has-guided-design-for-years/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/topic/8854-how-to-install-the-solidworks-flow-simulation-remote-solver/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/forums/topic/8855-using-ground-planes-in-solidworks-visualize-for-more-realism-control/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/home/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/index.php?/forums/forum/27-support-how-to-solidworks/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/index.php?/forums/forum/35-support-how-to-3dexperience/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/index.php?/forums/forum/40-social-off-topic/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/index.php?/forums/forum/7-3d-printing/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/index.php?app=core&amp;module=system&amp;controller=terms&amp;do=dismiss&amp;ref=aHR0cHM6Ly9jb21tdW5pdHkuZ29lbmdpbmVlci5jb20v&amp;csrfKey=e9c1e08d98a61e909698259b4c2781fd</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/leaderboard/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/login/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/manifest.webmanifest/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/online/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/ourpicks/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/profile/24611-teresa-wagner/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/profile/37304-tim-campanella/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/profile/40627-levi-tracy/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/profile/58-jeff-lendermon/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/profile/78-angelle-erickson/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/search/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/staff/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/terms/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/user-groups/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/user-groups/30-solidworks-for-makers/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/user-groups/32-students-and-educators/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/css_built_3/05e81b71abe4f22d6eb8d1a929494829_responsive.css?v=d815db93211778104854</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/css_built_3/258adbb6e4f3e83cd3b355f84e3fa002_custom.css?v=d815db93211778104854</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/css_built_3/311e677be1fd9bd34c1ccbaf8c789d99_promote_responsive.css?v=d815db93211778104854</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/css_built_3/341e4a57816af3ba440d891ca87450ff_framework.css?v=d815db93211778104854</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/css_built_3/5a0da001ccc2200dc5625c3f3934497d_core_responsive.css?v=d815db93211778104854</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/css_built_3/90eb5adf50a8c640f633d47fd7eb1778_core.css?v=d815db93211778104854</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/css_built_3/97c0a48072ce601c9764cb6b00a6588a_page.css?v=d815db93211778104854</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/css_built_3/aa0d3895a07f810ea9ac4b0e03928774_promote.css?v=d815db93211778104854</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/css_built_3/d95c7bcd2ea4a9b4edbe41e0b2c58657_rssauthorsync.css?v=d815db93211778104854</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/javascript_cloud/front_app.js?v=d815db93211787243904</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/javascript_cloud/front_front_realtime.js?v=d815db93211787243904</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/javascript_cms/front_app.js?v=d815db93211787243904</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/javascript_core/front_front_core.js?v=d815db93211787243904</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/javascript_core/global_global_core.js?v=d815db93211787243904</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/javascript_core/plugins_plugins.js?v=d815db93211787243904</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/javascript_global/root_framework.js?v=d815db93211787243904</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/javascript_global/root_front.js?v=d815db93211787243904</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/javascript_global/root_js_lang_1.js?v=d815db93211787243904</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/javascript_global/root_library.js?v=d815db93211787243904</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/javascript_global/root_map.js?v=d815db93211787243904</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/monthly_2021_09/1926825640_GoEngineerBugOption1.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/monthly_2021_09/android-chrome-36x36.png?v=1711473542</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/monthly_2021_11/726738616_JeffLendermon_19_2.thumb.jpg.6b9b09bf3181f1b3f48c9f569a1977ad.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/monthly_2021_11/Angelle-Erickson-Team-2021.thumb.jpg.ffc4540fb140757d99d524b2f81c2dfe.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/monthly_2023_01/Alex_cartoon.thumb.jpg.cdf3ecd4e48a2e651cf141abac8aa387.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/monthly_2023_01/goengineer_inline.png.dcb390b52157db8df5fe8f3c7bb186c5.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/monthly_2026_08/dynamic-spring-sw-nl.png.41fd679daf9a0b5b68b355cf3aae1184.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/monthly_2026_08/solidworks-design-premium-leo-ai-assistant.png.6d6d202abaab86eea65b8b94f9f7663b.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/page_objects/home.css.ff3e5641979cf1a7127ba41385b73aee.css?v=d815db93211778104854</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/pages_media/1_logo--welcome.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/pages_media/1_welcome-banner.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://media.invisioncic.com/n315104/reactions/react_thanks.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mygoengineer.b2clogin.com/mygoengineer.onmicrosoft.com/B2C_1_Sign-Up_Sign-In_GoEngineer/oauth2/v2.0/authorize</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mygoengineer.b2clogin.com/mygoengineer.onmicrosoft.com/B2C_1_Sign-Up_Sign-In_GoEngineer/oauth2/v2.0/authorize?client_id=da525270-7a83-4954-8cdb-5db90b3cd494&amp;response_type=code&amp;redirect_uri=https://community.goengineer.com/oauth/callback/&amp;state=5-aHR0cHM6Ly9jb21tdW5pdHkuZ29lbmdpbmVlci5jb20vcmVnaXN0ZXIvP2RvPW9wSWZyYW1lUmVmbG93UHJvY2Vzcw==-34b135308788feceb0bbbfac806e293b-aHR0cHM6Ly9jb21tdW5pdHkuZ29lbmdpbmVlci5jb20v&amp;prompt=none&amp;id_token_hint=&amp;code_challenge=gtw6YRaTJlIAgUIQMVghtNOK12yCXJZmNp3Kn-RGyvQ&amp;code_challenge_method=S256&amp;scope=da525270-7a83-4954-8cdb-5db90b3cd494%20openid%20offline_access&amp;response_mode=form_post</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect?v=2&amp;tid=G-E5TWVSKEYV&amp;gtm=45je68j0v869652202za200zd869652202&amp;_p=1787261445821&amp;gcd=13l3l3l2l1l1&amp;npa=1&amp;dma_cps=a&amp;dma=1&amp;are=1&amp;cid=434226143.1787261446&amp;frm=0&amp;pscdl=noapi&amp;rcb=16&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;_s=1&amp;tag_exp=115938465~115938469~118897920~118897930~119367802~119367810~120213116~120315470~120385422&amp;sid=1787261446&amp;sct=1&amp;seg=0&amp;dl=https%3A%2F%2Fcommunity.goengineer.com%2F&amp;dr=https%3A%2F%2Fmygoengineer.b2clogin.com%2F&amp;dt=GoEngineer%20Community%20Forums&amp;en=page_view&amp;_fv=1&amp;_nsi=1&amp;_ss=1&amp;_ee=1&amp;tfd=1464</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://script.hotjar.com/browser-perf.8417c6bba72228fa2e29.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://script.hotjar.com/modules.75bf3488a101739acfe9.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cloudflareinsights.com/beacon.min.js/v4513226cdae34746b4dedf0b4dfa099e1781791509496</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.hotjar.com/c/hotjar-2695290.js?sv=6</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/goengineer</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/images/goengineer_inline.png?v=eomoeboNvkrzRyz6J5bmcKXMApvnFVQ3rYqexyXiUT0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.goengineer.com/privacy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-E5TWVSKEYV</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/goengineer</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.invisioncommunity.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/goengineer</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.youtube.com/goengineer/?sub_confirmation=1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://x.com/goengineer</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://community.goengineer.com/&amp;dr=https://mygoengineer.b2clogin.com/&amp;dt=GoEngineer</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://community.goengineer.com/oauth/callback/&amp;state=5-aHR0cHM6Ly9jb21tdW5pdHkuZ29lbmdpbmVlci5jb20vcmVnaXN0ZXIvP2RvPW9wSWZyYW1lUmVmbG93UHJvY2Vzcw==-34b135308788feceb0bbbfac806e293b-aHR0cHM6Ly9jb21tdW5pdHkuZ29lbmdpbmVlci5jb20v&amp;prompt=none&amp;id_token_hint=&amp;code_challenge=gtw6YRaTJlIAgUIQMVghtNOK12yCXJZmNp3Kn-RGyvQ&amp;code_challenge_method=S256&amp;scope=da525270-7a83-4954-8cdb-5db90b3cd494</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://community.goengineer.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>community.goengineer.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>media.invisioncic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mygoengineer.b2clogin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>region1.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>script.hotjar.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>static.cloudflareinsights.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>static.hotjar.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.goengineer.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.instagram.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.invisioncommunity.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.youtube.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>x.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.16.79.73</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.127.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>162.159.141.105</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>172.66.1.101</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>18.66.102.53</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>20.118.56.3</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>20.190.160.3</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>216.239.32.36</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>65.9.130.6</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxps://community.goengineer.com/</name>
        <report_id>718bd2f8-8a0d-4036-96b9-b7e29753ae03</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>2fbad897d627e2eeac350c218de6622b31c0f93e6eef1babf90c2948635fa7be</id>
    <title>Analysis Report for 2fbad897d627e2eeac350c218de6622b31c0f93e6eef1babf90c2948635fa7be</title>
    <updated>2026-08-20T21:29:38Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8771d9f2677ae4d366d53e</_id>
        <file_type>message/rfc822</file_type>
        <flow_id>6a8771c10dfb99c1ceb08af4</flow_id>
        <hash>2fbad897d627e2eeac350c218de6622b31c0f93e6eef1babf90c2948635fa7be</hash>
        <iocs>
          <urls>
            <value>
              <url>file:///tmp/tmpbb2aryfc.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:indiapoliceintellgenceburu%40gmail.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <emails>
            <value>
              <email>774vo6od2JJw21iQ@mail.gmail.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>bulgariapolicecybercrime@gmail.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>indiapoliceintellgenceburu@gmail.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>inx.accounts@indiainx.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>10.167.242.20</ip>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <ip>209.85.221.172</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>ad5430eb08984cf0a9fba0b9a4fcf8d307fd0583862ffaa2e936d8b0579308c6</SHA-256>
              <SHA-1>18f9b4e9694c483459c974e83fc10962603d0b44</SHA-1>
              <MD5>b8595ba3e5f543e67c6b677a96b30143</MD5>
              <origin>EMAIL_BODY</origin>
              <file_type>text/plain</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>673d78df-7135-4df6-8573-dba39180888d</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>f80135ee-daa5-4166-219d-08defb459f9d</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>eml (27)</name>
        <report_id>1874bfda-7c8f-4a39-8c51-478b596f7161</report_id>
        <tags>
          <value>eml</value>
          <value>rfc822</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>b400679acbb2c608b72b6f03d337bfb3a5de66bf4ddba0a16e3f062ee1be79f2</id>
    <title>Analysis Report for b400679acbb2c608b72b6f03d337bfb3a5de66bf4ddba0a16e3f062ee1be79f2</title>
    <updated>2026-08-20T21:28:47Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87719bf2677ae4d366d52d</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6a87718e5a70bef4cd151588</flow_id>
        <hash>b400679acbb2c608b72b6f03d337bfb3a5de66bf4ddba0a16e3f062ee1be79f2</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>bc68aa056399c8bff23f7f75fdcb2c98b819862e18d548b9b0a482033e467274</SHA-256>
              <SHA-1>5e9f8fc2399652d5b487e9eea61bb16ab9a761d7</SHA-1>
              <MD5>513ab8afe927cb0aa88f2d2b709cbcac</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>Malachis_Menu_Reborn (1).dll</name>
        <report_id>7a969049-c0df-4158-8f22-da90621c4fa7</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>dotnet_pe</value>
          <value>reconnaissance</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>529f49b112f7291c4a7feeae38ced7238bc7d78b6429835e095f78429b21bf1c</id>
    <title>Analysis Report for 529f49b112f7291c4a7feeae38ced7238bc7d78b6429835e095f78429b21bf1c</title>
    <updated>2026-08-20T21:25:37Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877104f2677ae4d366d503</_id>
        <file_type>text/html</file_type>
        <flow_id>6a8770cf0dfb99c1ceb086ac</flow_id>
        <hash>529f49b112f7291c4a7feeae38ced7238bc7d78b6429835e095f78429b21bf1c</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cmd-official.com/items</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://cmdnkiqjije2tllr3biee2sjgj3i4robg2cbtilbnytdhh2wy3syrlyd.onion</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://cmdofficial.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>https://stewartbellandassociates.ca</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.bktool.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.contactgroup.com.au</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.lemont.ca</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.medlinkga.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.rondoutelectric.net</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cmdnkiqjije2tllr3biee2sjgj3i4robg2cbtilbnytdhh2wy3syrlyd.onion</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>cmdofficial.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>stewartbellandassociates.ca</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.bktool.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.contactgroup.com.au</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.lemont.ca</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.medlinkga.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.rondoutelectric.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>216.194.164.207</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>67.205.73.249</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>188.114.96.3</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>66.235.200.147</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>151.101.66.159</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>35.213.194.74</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>49e43d852b26680466895e34c40ac9b36c5287ce3f4c02c1e83724d72b669266</SHA-256>
              <SHA-1>f23a786fffd71550679e0b56c29509cdd6891a19</SHA-1>
              <MD5>4fdab1ba7efbcc0fbddff0981ec75945</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>fda139e9d2d35fcd974fe584ced70d1bb7e5cce42f25c95aa0970e073d023823</SHA-256>
              <SHA-1>413071326332edb9de6feb28433381a6f9322a09</SHA-1>
              <MD5>c01938d7fd7f8c0a1239e975827d70a7</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>8cfd55d9f24b516147c397784db700f0a6fc79560525caa874bef82cc98ffd18</SHA-256>
              <SHA-1>0439af3ecb4409f99237dc64c3a476dad42bf27b</SHA-1>
              <MD5>e2a461b5a5d05942d39ba32c8a40c047</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>21dd48523b37fe9d8587b41b8e3ac7fec4057713854dda39287dbf418430b706</SHA-256>
              <SHA-1>7b197ebdf449af76a9ea6687c4782648be04dcaa</SHA-1>
              <MD5>35518e06ffb8f23970889849f34557e4</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/xhtml+xml</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>a727cb5fca57e78c11a43918dc9bde26f676cb2b4b7dd253676c6c0c7c3abec4</SHA-256>
              <SHA-1>923d9018d587a733a13009f92c488d0407d6bb79</SHA-1>
              <MD5>502984d875998408a24027c974ee4618</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>b8650f161631a67f6e0907d3ad05874f78e2874b1584e747ea5ec9786201a328</SHA-256>
              <SHA-1>92facb57e1a2da0a22b1d982cbb79a5d25d0b270</SHA-1>
              <MD5>1d1a8aabfdb90c9c55c8a8fd242369a1</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>bf8a5beacb7822f220e79b88f1154cc310eefa873e01079c1462a5aba4eed1fb</SHA-256>
              <SHA-1>c0f88bd5367374c980071e0a06b356cafb295ef5</SHA-1>
              <MD5>adf8d8698fc24b3acacc58a111638849</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://cmd-official.com/items</name>
        <report_id>a03150ff-fb51-48fa-bc61-2dd5d7b16718</report_id>
        <tags>
          <value>html</value>
          <value>xml</value>
          <value>tor</value>
          <value>captcha</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f929113bd563416ed48528521189869373c72d204592b1bbc0e23c87a09630b2</id>
    <title>Analysis Report for f929113bd563416ed48528521189869373c72d204592b1bbc0e23c87a09630b2</title>
    <updated>2026-08-20T21:24:37Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a8770c1f2677ae4d366d4f0</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a877092f72d6ce80a2727a9</flow_id>
        <hash>f929113bd563416ed48528521189869373c72d204592b1bbc0e23c87a09630b2</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schemas.microsoft.com/SMI/2</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://bit.ly/fitgirl-repacks-site</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/CSPCA.crl0H</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/tspca.crl0H</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/DirectX0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/CSPCA.crt0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/tspca.crt0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://restools.hanzify.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://bit.ly/fitgirl-repacks-site</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/SMI/2</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>restools.hanzify.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>bit.ly</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crl.microsoft.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>microsoft.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>bit.ly</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>Y@Z9H.5B</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>67.199.248.10</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>109.94.209.70</ip>
              <origin>BATCH_SCRIPT_EMULATION</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>1.0.0.0</ip>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>109.94.209.70</ip>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>2.16.241.12</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>151e1b320b584dda2184c5084ce2ac9ce81c67b0102ed65d4f37c7e560f698dc</SHA-256>
              <SHA-1>56b2b97429667cc63dd88c2516baab4655f667a4</SHA-1>
              <MD5>aa853eb2a7992daf5fa174320f797d1c</MD5>
              <origin>PE_EMULATION</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>f5dd74afbe58f041179ed271630e03a70a5ae94534b45e6f4b546b202ff05b34</SHA-256>
              <SHA-1>33755a36413e300ce14bda838ee506e48a265396</SHA-1>
              <MD5>00c6522fbe5703a873c2faad6c69f03e</MD5>
              <origin>PE_EMULATION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>39c965edc8f577695dadd68d6d40ace4e1e17625ca4669e3f1321b6b26e470c7</SHA-256>
              <SHA-1>315a5e4f3bc5472dea5375a986dd6f6fb35b2f17</SHA-1>
              <MD5>bcd4ebd26140038f1e45ba5c639d9ad4</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>4500a02f7883a5f16b4b8dac6dfe7e3eb43bba8ac833258fb029c2a970d82855</SHA-256>
              <SHA-1>9e50e4dc1fd1dd782b6181bd59011340486b8e3d</SHA-1>
              <MD5>b1377c69e6897fdb715452b1776fad57</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>text/x-msdos-batch</file_type>
            </value>
            <value>
              <SHA-256>52c28d2f80b18bd237de3243fdbe326ab1bd278ba52026ee524431f16aa52905</SHA-256>
              <SHA-1>39337797ead30cb51562e036eadc5f61b65c3a49</SHA-1>
              <MD5>7ad88e752ab85ccfac386ad7a25feea9</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
            <value>
              <SHA-256>651d3439fc35ad4a9cce5a04d2f8878fdf04598b50845a64ab5518b70b28c485</SHA-256>
              <SHA-1>7dac29f0b65618fb1b8f8f2c14894e166403de27</SHA-1>
              <MD5>ac0f3a233bc1ade90a257e5b78e0e03d</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d</SHA-256>
              <SHA-1>8d5fd0a741dd3fd84650e40dd3928ae1f15323cc</SHA-1>
              <MD5>f07e819ba2e46a897cfabf816d7557b2</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-msdownload; format=pe</file_type>
            </value>
            <value>
              <SHA-256>6cf1b57d59e7111bc218dfb01dda93ac0f776715599a1c69f89035bd20c16a10</SHA-256>
              <SHA-1>d37c2b3927946ed617455b3c5913fcab0bc1af52</SHA-1>
              <MD5>b4202f7fe985b9648b4676e6f70832bd</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <SHA-256>eae201fe064e6edd66f1895c9bf2be3529ab6331192d102e1f805145e4ff728d</SHA-256>
              <SHA-1>5f542aa7806068b7675fa78f09b729b0ff3b0945</SHA-1>
              <MD5>7ebe012825c25397c15de2b57b818e75</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>text/x-innosetup</file_type>
            </value>
            <value>
              <SHA-256>ed79c8f65b02ed83d5db8c355328294a73dc447f08f657312bf8f3a5b40c7494</SHA-256>
              <SHA-1>ca133f67a286f4f20282e19837b53b38a27a1caa</SHA-1>
              <MD5>56d52c503adf02184f19eee4767ef60a</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-dosexec</file_type>
            </value>
            <value>
              <SHA-256>f84677643d9977aa1e8a4aa8c85a12665d29a4e8292485a0b4df846dd161f824</SHA-256>
              <SHA-1>817434cffcef953111182a34aba7d7b6c56495f9</SHA-1>
              <MD5>0ef04bc15fd1b28975aff2951b857f03</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>cb7cc347e8be1c1164c1d1fd64088e9d3ae373d4fcdebd86356cb26dca3930c3</SHA-256>
              <SHA-1>87c9af02f174b33b5e64a6b51c58d328006276e0</SHA-1>
              <MD5>22c9b104063f483d1cafcd07abc5f71c</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\</registry>
              <origin>CONTENT_PARSE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\App Paths</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\RunOnce</registry>
              <origin>EXTRACTED_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>System\CurrentControlSet\Control\Session Manager</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>System\CurrentControlSet\Control\Session Manager\FileRenameOperations</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Delphi\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Locales</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\</registry>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Delphi\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Borland\Locales</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>setup.exe</name>
        <report_id>71d5abd4-0cd4-4742-adef-dad328eb73f7</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>packed</value>
          <value>cmd</value>
          <value>lolbin</value>
          <value>adaptive-context</value>
          <value>rundll32</value>
          <value>evasive</value>
          <value>installer</value>
          <value>reconnaissance</value>
          <value>runonce</value>
          <value>fingerprint</value>
          <value>expired-cert</value>
          <value>inno</value>
          <value>embarcadero_delphi</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>3463505fe999ac7048d7bbcc6b9982b0b89e21673469b827942e5b74cd100532</id>
    <title>Analysis Report for 3463505fe999ac7048d7bbcc6b9982b0b89e21673469b827942e5b74cd100532</title>
    <updated>2026-08-20T21:24:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a87708bf2677ae4d366d4e0</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a8770805a70bef4cd1513ea</flow_id>
        <hash>3463505fe999ac7048d7bbcc6b9982b0b89e21673469b827942e5b74cd100532</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df</SHA-256>
              <SHA-1>4260284ce14278c397aaf6f389c1609b0ab0ce51</SHA-1>
              <MD5>1e4a89b11eae0fcf8bb5fdd5ec3b6f61</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
          </files>
        </iocs>
        <name>DSPTool.exe</name>
        <report_id>3fb65a9d-6c28-4c81-a1a3-1b71b000db64</report_id>
        <tags>
          <value>peexe</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>anti-debug</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a8ba7f503b795563a9f29d7fe89f4aa80d9d68e5e70c95911301834d8083b678</id>
    <title>Analysis Report for a8ba7f503b795563a9f29d7fe89f4aa80d9d68e5e70c95911301834d8083b678</title>
    <updated>2026-08-20T21:22:36Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877064f2677ae4d366d4d2</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a87701a0dfb99c1ceb08398</flow_id>
        <hash>a8ba7f503b795563a9f29d7fe89f4aa80d9d68e5e70c95911301834d8083b678</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>0da26594f64324655c801e9022d653bb63c8c35a6e9edd6ea4e3b9f7d9904a89</SHA-256>
              <SHA-1>90a6291908c26f651d45cf00c6a2c3cb6fbd80ca</SHA-1>
              <MD5>f12179c9ce9f72dac80d606529555ffc</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>0eeb8f220ad601be76418a59bcd56a437aa1c997276357e4442327707b034267</SHA-256>
              <SHA-1>7de25dd2b6211777214072ed4b326e801e83a9f3</SHA-1>
              <MD5>cd6cc4b4eb60195fced66524922ac8df</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>1bca3129613d3e5019ac4bde03e99fc598190d60cde05f61633c1eb18eb5884a</SHA-256>
              <SHA-1>fcf6033db30ee055693ece58ed9030ffd7a2df52</SHA-1>
              <MD5>b26a95161f6eeb733f09f4578b1f8d7a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>232f3760901066825d2cfbbd602fe208d3bee743e0a35f82246d3b537c1d671b</SHA-256>
              <SHA-1>97de9962fbe5547c3ba78c7ca0571824692fc8a1</SHA-1>
              <MD5>fdae3c0724d75156f820ea1060378cf7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>3cd553f6ca40cadf88f7f71b88b8711cd71acf42e312f65ed7af1a4486f5a757</SHA-256>
              <SHA-1>c6fd63cb3003294a1e242ff1e14f2887241700d1</SHA-1>
              <MD5>7ee35d6b800063a6ba5246ff2e02d388</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>42d64194807b60647c37cf9eb38d9b29f47f89fe78d7ddbbd5bac5e68ce39551</SHA-256>
              <SHA-1>caf42627191feea43ab280e3b0216f8d4b73486b</SHA-1>
              <MD5>e8f6e6c1bd67a92ae78861e20cf992b8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>431e844bde18f905f3b0922b381f2f68accd21c87a86409314f77fc74432a57a</SHA-256>
              <SHA-1>97ff0588193fbe2b509071cba0b7e7cefe2f2c6f</SHA-1>
              <MD5>f72a1569204e2b6a237e3b1137c9f2e5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>43bd77d9b303cd7d4a2cc5b77c6c777fa872b27927d484ae0f556f0b1967e541</SHA-256>
              <SHA-1>596de9a1951b47c540de76f7e96df11d238ea10a</SHA-1>
              <MD5>1f745f28fe7133fef6e9108e9bad2f7c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>5250fc7bc0186211009e1862ba023e7deaa120f071780e0d9c6caab90bbc5052</SHA-256>
              <SHA-1>7ac2c0635f0cf6f554e4d5383d927d39581c2126</SHA-1>
              <MD5>fef12dd2aaccb496e91e3d632418daf5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>6b4efc3dbd9e5520e3da09ddbd73f8456397571dd6156ee97d304494ff0f394d</SHA-256>
              <SHA-1>f070e28ae8c213329527d3ff8ca059cfdb7deeb4</SHA-1>
              <MD5>777b2adea77f85dca99839f4fa9679ad</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>8d0d2c0df3b55f7ca8d7b5024d781ff3bdc331f6c63e1dd0e63f012304995e7b</SHA-256>
              <SHA-1>48951f282edb9703477dab1dced0e029ba44a62b</SHA-1>
              <MD5>6466ea4de98c7533ab77a576924e3357</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>8fd4951a430aa99e8069a617464f00a9f26a08d570175075c8b30bc158696298</SHA-256>
              <SHA-1>5fd32bbcbd3155f611c22abc175423fd6a718215</SHA-1>
              <MD5>233caec2d6c9b0d94e086ee5962b408f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>b6db39c9cfc0d0f676f56fd7ad3d4d39c6704cce05d90da196b3a558d385253e</SHA-256>
              <SHA-1>2393c9047828e9a16dd8edb292baf53d44c71f7e</SHA-1>
              <MD5>ae12212b4fd28f6db39cb996ca7be9d2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>c10d1bcd6f769ff29536eb460b1b3c7ca229d0680b6e2fc5693236b41c0734f9</SHA-256>
              <SHA-1>300f7e41f44c7071dc8591c9e9acecdf354159fb</SHA-1>
              <MD5>e73da5cbbebe989f309ed32630d96f77</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>cb69681d963ca18f827f18b280bef1fe581e9d804f08c68b51bef405bc8b4826</SHA-256>
              <SHA-1>0369fee86cdacfeeaec28c65441e61910225b487</SHA-1>
              <MD5>1d1970d585474185734f1f33d2434179</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>cc8efc9dfcf1988f9873f5eb05450a27408666ff4dce40cebbd58090c6e6c5ae</SHA-256>
              <SHA-1>fe6c88c86f92233aa54cf23951f08c433ee35d7b</SHA-1>
              <MD5>dc8a6ed72f8dfe87b610d86281951caf</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>cf104654e7ad4db43017b1d9614d22cb1f9826b61ef53780fa1a834369e7d754</SHA-256>
              <SHA-1>18dc31e09c8467e72edd2f436b1238cebf0a3f69</SHA-1>
              <MD5>a7ba31130c99060851dec3f67e0e5778</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>d2969bf4d89e9f1f7c5d4def92632d77a42db910a7185da9e4f91ddbb0776f47</SHA-256>
              <SHA-1>1d2502a3d43c9558565af1d7bc90c4f74d25c392</SHA-1>
              <MD5>2837e933f2b8b1f5f78fd8bce6d280f4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>dbf6d5021777f4b7ac549c86e00522c84bf6687ef0333025f663333fa241c9e7</SHA-256>
              <SHA-1>7f4907256c6418a272b9b66bce1bb688481b0ff9</SHA-1>
              <MD5>e0cf33b40a275489b084fde75443841f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>x477e30:$btc: 3333333333333333333333333333</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>Dolphin.exe</name>
        <report_id>c86a3ee6-845e-44d8-a04d-b8f9df57c6fe</report_id>
        <tags>
          <value>peexe</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>anti-vm</value>
          <value>anti-debug</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>929fc3fcd696fdeac555eb60b548511ed8adcbce5ba0e1ab1ec5c6532133005a</id>
    <title>Analysis Report for 929fc3fcd696fdeac555eb60b548511ed8adcbce5ba0e1ab1ec5c6532133005a</title>
    <updated>2026-08-20T21:22:24Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877083f2677ae4d366d4dc</_id>
        <file_type>application/x-msdownload; format=pe32</file_type>
        <flow_id>6a87700e0dfb99c1ceb08358</flow_id>
        <hash>929fc3fcd696fdeac555eb60b548511ed8adcbce5ba0e1ab1ec5c6532133005a</hash>
        <iocs>
          <urls>
            <value>
              <url>https://github.com/JohnnyCrazy/SpotifyAPI-NET</url>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <url>https://github.com/JohnnyCrazy/SpotifyAPI-NET.git</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://unpkg.com/tailwindcss</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://127.0.0.1:5000/callback</url>
              <origin>DOTNET_DECOMPILATION</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://accounts.spotify.com/api/token</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://accounts.spotify.com/authorize</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://api.spotify.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://api.spotify.com/v1/</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>github.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>unpkg.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>accounts.spotify.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>api.spotify.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>35.186.224.24</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.1.22</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>127.0.0.1</ip>
              <origin>DOTNET_DECOMPILATION</origin>
            </value>
            <value>
              <ip>1.2.3.4</ip>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>140.82.121.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>67e418c01bb527f9630609e8939aa071f4e7ab7ae74133e548b5228fb4bb398a</SHA-256>
              <SHA-1>70f48b3e356ae058aaf52b7d5423cf6ee1500191</SHA-1>
              <MD5>21c905e1ca1ee67080e5769a925df389</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>7f9b8f0ffef3ae445374125cf8319a1c926c29f76f03366e7b52cfda7f56b086</SHA-256>
              <SHA-1>03157dfd9cd66377b5d7fefb86939d41d79881bd</SHA-1>
              <MD5>2bf3eae30674e55170db49d4c991205f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>67455888a9ad5c9ebd6822511ab6e9e6ae7590ab758bb581550ed22fc28d42ca</SHA-256>
              <SHA-1>d5d8fa1fc0c18b6d08b645b56c3beb9d486324b2</SHA-1>
              <MD5>bb8aa2cf871557b81c1404c7924c1f02</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>ffb68e30e1b5dfe5a8233197e07effa39d96c6d62d096d9e2774b1a9239dd8e6</SHA-256>
              <SHA-1>4e6031079aab5498d43d136cb2a9ab9baeca76f6</SHA-1>
              <MD5>e413c73e9027816e908201c785bf713f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/json</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>f954db5194b015c75543326771da7958fec1b1691ade4dbbff1c6f75e13afd97</SHA-256>
              <SHA-1>0efb1dd91040024fa33a09e58cd9713ac18fe31d</SHA-1>
              <MD5>e014f6924d9225e430b03b9c70336db5</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>b1ad2f9d383ef7e0adb2760405b4a8518ae632f1e7efdd2963bec491c44e2f69</SHA-256>
              <SHA-1>fbb8391b106a43404523932677d7f629eebd6775</SHA-1>
              <MD5>7cbd46a417068e34a9fd128d338e3375</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/css</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>ce2739ca9d3936440209ffe5adaa22cb44ef0fedd48acc12d618e0eda7bd5e50</SHA-256>
              <SHA-1>efdc264c0e40901f745b6d94cd427907bb6f06e5</SHA-1>
              <MD5>d1b9c766efda6f2a6a8e747228587f1f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>adaa04bb-8b63-4073-a12f-d6f8c0b4383f</uuid>
              <origin>EXTRACTED_FILE</origin>
            </value>
          </uuids>
          <btc_wallets>
            <value>
              <btc_wallet>x5b4ac2:$btc: 1wEAAAwAEQAANzMVMhYVFA4CBy</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>SakuraClient.dll</name>
        <report_id>d73bba8a-bb7d-4273-a81e-8d6b69d60840</report_id>
        <tags>
          <value>peexe</value>
          <value>txt</value>
          <value>pedll</value>
          <value>html</value>
          <value>dotnet_pe</value>
          <value>json</value>
          <value>corrupted</value>
          <value>evasive</value>
          <value>packed</value>
          <value>overlay</value>
          <value>base64</value>
          <value>explorer</value>
          <value>lolbin</value>
          <value>netsh</value>
          <value>finger</value>
          <value>obfuscated</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>3c3e2ea93f4c8c39be1f180717c27279a1cc164213079ba7645337ba522f3751</id>
    <title>Analysis Report for 3c3e2ea93f4c8c39be1f180717c27279a1cc164213079ba7645337ba522f3751</title>
    <updated>2026-08-20T21:22:16Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a877019a7edcf8232f85c66</_id>
        <file_type>text/plain</file_type>
        <flow_id>6a877006e2a9f641177b5eff</flow_id>
        <hash>3c3e2ea93f4c8c39be1f180717c27279a1cc164213079ba7645337ba522f3751</hash>
        <iocs/>
        <name>3c3e2ea93f4c8c39be1f180717c27279a1cc164213079ba7645337ba522f3751.unknown</name>
        <report_id>91f16ac5-5d23-49f3-af46-6bc95d7dae6f</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>1944c0336e1c25a210bb82d325a09cc8f49f59f6ae7aeb69fde77fa750a100f5</id>
    <title>Analysis Report for 1944c0336e1c25a210bb82d325a09cc8f49f59f6ae7aeb69fde77fa750a100f5</title>
    <updated>2026-08-20T21:21:29Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876fe5f2677ae4d366d4ae</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a876fd80dfb99c1ceb08263</flow_id>
        <hash>1944c0336e1c25a210bb82d325a09cc8f49f59f6ae7aeb69fde77fa750a100f5</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schemas.microsoft.com/SMI/2005/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/SMI/2016/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>09ff79172bd31345105c714c0ef67947600b1fcdb7380b1605acf9e33a3cda06</SHA-256>
              <SHA-1>47c2382d453844de7e4000e0dccac0e10032e4f5</SHA-1>
              <MD5>524cddee7650db6865f1b2087e7b8e4d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>137e2d21782b052a0a1d6ec6527bd77a701d6c98ddf9864cb1e8e9dc09122103</SHA-256>
              <SHA-1>1be97b4e30213ed47bfbc22a8f28f588ac03cad3</SHA-1>
              <MD5>5429fa585d352e1b933ec0f96ef5120b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>240f02a37ea7c2c30ecf13dc611b8456d1fecb53ba992b4264f7b1ba09258cdb</SHA-256>
              <SHA-1>98fe949ca2f9d766e4fbe8e058cb2a66191439bf</SHA-1>
              <MD5>8c93ded4f28a84fce3c132bc091fb931</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>2e85fc1a30ddf24a0210809fafb3905d0bd760220fec72c6fea9150e3c329443</SHA-256>
              <SHA-1>d2267eed4151b464270ca171991ba6ad88194e2d</SHA-1>
              <MD5>33ea97c483a92fbd8619681500d6bfd0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>44fdd41fdac8fbd9c13cb58a6e223c86baa1cc23b11b90d527c55f62ad4b6990</SHA-256>
              <SHA-1>032a26b84ccc683ab9459fe6a19a7307d038e299</SHA-1>
              <MD5>6012c532c7373b0065b54cf4f58f278b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>50d692dbe7909ab7d691c285e23f8bd2dcadd7daccc9f61c97bbc3052c0737b0</SHA-256>
              <SHA-1>c0bd19b484de531ef7ce6542915f4b05d890f10d</SHA-1>
              <MD5>505b5d1018436db59d4e6c77c0f7c58e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>5c92a41adaf3265071482fd1a182ae8702c168636a7d9ff51798ee3a1dfc8500</SHA-256>
              <SHA-1>d046e23f2ee2b93ad96be8e1dc9120ecf3915091</SHA-1>
              <MD5>f7731730720cfe035cf030b40d0e2eb6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>61e6e0979faa1ce96861209ef3521bb16799a6b46aa9d4d7791243d8b4dbfbb1</SHA-256>
              <SHA-1>6f6c9d74c195eafd494563b2934948be5a3433bf</SHA-1>
              <MD5>8680e8315f4b01d8b2c840377b40df54</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>622c57c45cda7936dff66a15086f2a552fd3d81c8c47ca7c016e85ce4376d4a9</SHA-256>
              <SHA-1>c9aae6dfc2180160e4fd63e256516ecff524859e</SHA-1>
              <MD5>05049dbc3e90706c0d7f4855421ac84b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>79025bb08b6464ebcbb173e621c7ae9be4771a12b8a9da5e32d95e2d3434084c</SHA-256>
              <SHA-1>9580430227a3fd1c953def614bfab73ec49c154b</SHA-1>
              <MD5>74e4e6dc3fdd68b3f444e609b0ce5a2d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>806d51af078ff424fefb0249090a8fcabe52aafd4f844860e84f4cb2e17a0e73</SHA-256>
              <SHA-1>4c0189bb16654c112c688533ee5786cd47f0803b</SHA-1>
              <MD5>6bf8beeb291411a18fa8eb221ad54477</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>82f96b3bb434f948f117167b26abfccba88c6f9b932d746c5fa5b4ca2fdbc87d</SHA-256>
              <SHA-1>7939d7481bd04135df5622460f3ff60970ac69ba</SHA-1>
              <MD5>25281ddd1612aaa1c8a8c2e37d6b00d1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>9913b6c6c4ffd4224ba00adee0ef90031865e0bb30b8a75f2c6cc2b8674dce0f</SHA-256>
              <SHA-1>4bf286268c463195d1d6f74f75e1056f21bc0948</SHA-1>
              <MD5>2f63318b7794929c7a89baa9b98a076c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>aa8be25a00880fbaa6a50d7b7545a8b2a1b2b08e793d0dfbd6f2ceaf744f30ac</SHA-256>
              <SHA-1>3a2d6452ab8ae737b102c933cb521d7504650853</SHA-1>
              <MD5>689d3f27415c6c0058f04ac53e9258ba</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>b309e39e91f4f51795f0fdca2c475ea9738267892f7e9b5fbe623def60d64b79</SHA-256>
              <SHA-1>6a48ec187f6a39a69215a69ccea1818ded4f94f2</SHA-1>
              <MD5>bf931dac13b2ec8bc9123c9c09800b2b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>b4a531e13fb388c0ab4a6bf08f7fad7fc5807553cc28b215f6cb12e435f3cf2a</SHA-256>
              <SHA-1>a3104b1757c60a708288e3f762894fa14228ff91</SHA-1>
              <MD5>6611b76fc2ac85bf076f5192ca7c4f10</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>c7ad67f87b6528d7c62cf831461b29f8016a9ff92771daddc05fddd05db4171b</SHA-256>
              <SHA-1>825eec34b18035aee6871d6e2a70df5f4e0400a1</SHA-1>
              <MD5>80047c3a9500d5f41820f0e507b01c6d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>eff7a8b13967c48fb1dfaa2bbffb959f6ff6e7658aa709374f88b9c377a8c78a</SHA-256>
              <SHA-1>326ca62645b78c271dbb610e253d6526d96974a5</SHA-1>
              <MD5>c5d90c0241c8eff004e3d898165a7c69</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>f93f8ddfa2a9d4173345535aabd930d7854679d117800863f433976342c7ddf3</SHA-256>
              <SHA-1>e01f3a0ad36940aeb6eb8d0fafb00d40ab5181ad</SHA-1>
              <MD5>fe33724e3dcfa13e37a97947e6290b1a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <btc_wallets>
            <value>
              <btc_wallet>374c3a48e1ae8f15369f1244917929c1</btc_wallet>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>Project Virtual Girl.exe</name>
        <report_id>d575e8d9-977c-4eed-8f8a-afc8207f54ce</report_id>
        <tags>
          <value>peexe</value>
          <value>microsoft_visual_cc</value>
          <value>anti-debug</value>
          <value>anti-vm</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>08e7c5adde3b3ba05bf418789b08b859d41fca8f948f5ad5e9678d7ca4f13475</id>
    <title>Analysis Report for 08e7c5adde3b3ba05bf418789b08b859d41fca8f948f5ad5e9678d7ca4f13475</title>
    <updated>2026-08-20T21:20:11Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876f9cf2677ae4d366d498</_id>
        <file_type>text/html</file_type>
        <flow_id>6a876f88099a97c449ef45a5</flow_id>
        <hash>08e7c5adde3b3ba05bf418789b08b859d41fca8f948f5ad5e9678d7ca4f13475</hash>
        <iocs>
          <urls>
            <value>
              <url>https://quynco.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://quynco.com/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://quynco.com</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>quynco.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>188.114.96.3</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxps://quynco.com</name>
        <report_id>c19ee6e5-b001-4be7-a04e-f3c7150cfa97</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>4d53875a7fc6f65842488484d95eae9df10a7ace1e4cebdd6f4959770500f5d0</id>
    <title>Analysis Report for 4d53875a7fc6f65842488484d95eae9df10a7ace1e4cebdd6f4959770500f5d0</title>
    <updated>2026-08-20T21:19:44Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876fdef2677ae4d366d4aa</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a876f6d5a70bef4cd1511c8</flow_id>
        <hash>4d53875a7fc6f65842488484d95eae9df10a7ace1e4cebdd6f4959770500f5d0</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>07382c0d91dad2bb6ba8bd06ea02f12c57abf7c4e5a70672e9f2954d09a4ffd4</SHA-256>
              <SHA-1>4ec6eed0bac5a8801db10238c7b3a5d35a87be67</SHA-1>
              <MD5>f91e1ff896b5616919ac97c7095c513e</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <SHA-256>0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9</SHA-256>
              <SHA-1>b370eca8fa727e46cf61d834fcc956698b02e1fd</SHA-1>
              <MD5>bc88b387cafa556068b5c5d6ff3ccc8f</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload; format=pe64</file_type>
            </value>
            <value>
              <SHA-256>2405355f0a58067b258f8df33c327e3a3d716eaac5a3a5aebb757842d85bd376</SHA-256>
              <SHA-1>1ce87fac4c22aae82a81ddb26952c074b744e78d</SHA-1>
              <MD5>5fe9a647921ded8a2fad92deb9ec4ab2</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload; format=pe64</file_type>
            </value>
            <value>
              <SHA-256>2a466648affd3d51b944f563bb65046a3da91006a0d90fb2c0b123487a1fc1b3</SHA-256>
              <SHA-1>69ed09faae00a980c296546c9b5e6a8d5f978439</SHA-1>
              <MD5>429c26ed27a026442f89c95ff16ce8c2</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <SHA-256>4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df</SHA-256>
              <SHA-1>4260284ce14278c397aaf6f389c1609b0ab0ce51</SHA-1>
              <MD5>1e4a89b11eae0fcf8bb5fdd5ec3b6f61</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>4fb7fd62648be6256ff175b9ad90d96d2c25a803745e965538ed87367b190498</SHA-256>
              <SHA-1>55dbeae7b5f81d02fb2f3a9a90ba6d7b3b97a5c5</SHA-1>
              <MD5>244b74b641fdd22c233347d179181006</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>51541ec6684b43157a85ea46a42ebed4555be06bed0d0d07ff3ea6377301318d</SHA-256>
              <SHA-1>f982f3bbb4dc3aaaba8df098d1b395846f7cba08</SHA-1>
              <MD5>42a2a95f1bb940d01f55eb1674a81fe2</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <SHA-256>5394339a41907da77462b3acaa97b0fc4003159cecf211b8563806a6d63693c5</SHA-256>
              <SHA-1>3f6ded09242c014bd7e6664b750767177b5ce9c0</SHA-1>
              <MD5>8792d9061f4b226137057e71b87cf25f</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>5789ca1822f3a5a67cd2c24e6ff0307e688b76a2e99831050bdcf8b8d155956d</SHA-256>
              <SHA-1>2423105a960fe0ceb038ca36d6a37638ebd32b6f</SHA-1>
              <MD5>d562628f9df56ae61770ffdef79c8d05</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>6cfa2891cceb847b20c9664b317ab0598824ceb8ba886448325afd6ff8d03075</SHA-256>
              <SHA-1>7fac5c7a38332fe97caf3e7856d1348262fa83cc</SHA-1>
              <MD5>7cd4cdf0622e20b44005a5bb41c31d26</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>7bb8644e565ad4bcfd890f9044bccb4d99953a740e9a500b1f820b2fdc3fc240</SHA-256>
              <SHA-1>efb868ba125d9ff08474f02b9483d74c36a13cee</SHA-1>
              <MD5>ff48b107b2449a647c64baabd49408a1</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <SHA-256>80139e4caa379d87b1d1dafc23ace71d2b330368115f6314140d4ae59c2a78e8</SHA-256>
              <SHA-1>725a8b8fdfbe6a1e85674f4b2a7c0dd08411e00b</SHA-1>
              <MD5>98da186fd7d7873c164a51c5d7b77f1a</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <SHA-256>84425efa675012d33433c4c1c43836811d74be8b3e53a04947566f19356803d3</SHA-256>
              <SHA-1>64953c05cbb41f5297808069b9c45d6ba33f633b</SHA-1>
              <MD5>3c16dc3a8bca4e7b1e9cd1413301bb54</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>8645f1b6bec48f061e54941ec1d9c5e4b8096ce1a80d8ea0a0353e4cb557f8f5</SHA-256>
              <SHA-1>62dd8f17cff9916faa792a8188f8e82ed6edf9c8</SHA-1>
              <MD5>8c14feded4b94c4b72af1f710f236778</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>8a7bff1c918539a75c25568db25933d653c003e016fd7791a37186b42bbb7c20</SHA-256>
              <SHA-1>97a9053a311280678f8ef65dc4e25975c41bd4ee</SHA-1>
              <MD5>e10e077bb06209aedd0d0d378c758f73</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <SHA-256>94b6e91b93c2202dabd659bff294bee87c22897a30a6b4930b49051c2fb502dc</SHA-256>
              <SHA-1>e2cf163ad067b5d3b19908a71ed393711f66cd09</SHA-1>
              <MD5>c8dbf0ca88facfe87899168a7f7db52c</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <SHA-256>984306a3547be2f48483d68d0466b21dda9db4be304bedc9ffdb953c26cac5a1</SHA-256>
              <SHA-1>eaa07829d012206ac55fb1af5cc6a35f341d22be</SHA-1>
              <MD5>54f27114eb0fda1588362bb6b5567979</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <SHA-256>9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37</SHA-256>
              <SHA-1>d8d449b92de20a57df722df46435ba4553ecc802</SHA-1>
              <MD5>792b92c8ad13c46f27c7ced0810694df</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <SHA-256>a984ec7dfd04818494d9156c84b88e6c293c885bbc5b51c68101b96c80727c25</SHA-256>
              <SHA-1>d673aa8461210284f1f1cd81ca08ae2973f24518</SHA-1>
              <MD5>78941f835e77ca0a93124f762621c16f</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>bb25c0ac214a9e7aac891ca54327ef3ada383e4f7b1b40c9e7ae955f3d23de1e</SHA-256>
              <SHA-1>6056b352103f04de622cd963aee1c9c8cbdbdac5</SHA-1>
              <MD5>058c57a3a049103a08753978c77952e4</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>bf4ea10be1b64c442ac0ccf4bdf69f6703467176a27e9e14a488d26448a6e179</SHA-256>
              <SHA-1>1117709f577278717c34365ce879bcd7c956069b</SHA-1>
              <MD5>0f593e50be4715aa8e1f6eb39434edd5</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <SHA-256>bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d</SHA-256>
              <SHA-1>9ce5c3d6c7d94b175f136f552af8771dca6147b3</SHA-1>
              <MD5>2a214cb2f0f9473e7765ee3b8db8651e</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>bfc059e16951fa90cc14489a8263f35c6703e762f2f5413682b4f7935bbced57</SHA-256>
              <SHA-1>de9edf5c9ac80b1f26dcc91d89791065097a7d23</SHA-1>
              <MD5>754fff93ed112eb26bd4a6b0e8300deb</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>c2101c4806bb3199e9ed6f0529541024fd14b9c6fad37f79bdbf1fa51e5cbc8f</SHA-256>
              <SHA-1>562810fbfa1144e49edf07c1faea4fd3f37240a6</SHA-1>
              <MD5>168e08b25d2445a03157125f66b07e80</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c682c86d779df8cb6513c3efa65addd5422fc22f89dab8d77b11e5d655368ff9</SHA-256>
              <SHA-1>e183e926528e7a781fd432fd481f9040746b6432</SHA-1>
              <MD5>e6e49bf8e5c81916b035f438236ed5b9</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>c6a0a81da0365fc3260fe76e891de5dcfe8fdcfeff1c6b50313dea8e007ebf19</SHA-256>
              <SHA-1>64dc3852f95c05265f3514c2b2a9ce5448eeb4f5</SHA-1>
              <MD5>3886945952e844b6e8b2924622534bd7</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>d83d854abacc9d90d2d59c2db0ea9b9e91426f7acdd8d7b0ad9c3a9d3b2f2be2</SHA-256>
              <SHA-1>0592be23fa119d21c6ec0f99479a5a4fb635296f</SHA-1>
              <MD5>73509af652f1d623e737608405310531</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>da833b4cb9d7bf1f912eae3fd524fadc60df2a4d6afc01438cab830cfe6ab0db</SHA-256>
              <SHA-1>36dec5f6a07aa4d2f8a52aaa400def159fd1ea55</SHA-1>
              <MD5>dddaea703d92e7a0afac31590b9c00cc</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>e142752e073c0051a0beb963981af70263ed673959515545521a7941d3230838</SHA-256>
              <SHA-1>4dcf9ebc3ff5ca552c0e83469b921153b29aea1f</SHA-1>
              <MD5>dd78b86b3c92d61c37b44ef5b157cfe0</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>edcfaee94884dc2ce87f9c6fde5fa01a8de0548c83c86422614af2adbdd14e66</SHA-256>
              <SHA-1>a22f2b19c5bd51961294f916576e0abce0bb0615</SHA-1>
              <MD5>45ce82cf320a6d788b9a2d715a687263</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>f6b58fdde3bfef2c25c7254fadfed12d86d81c4a5c962262715868c48063fc76</SHA-256>
              <SHA-1>0383a4d7a74417d3ec90526e61b7637256e0bb57</SHA-1>
              <MD5>68cf6f98cb8b227814a59ff3f909a0af</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>f7c6c7ea22edd2f8bd07aa5b33cbce862ef1dcdc2226eb130e0018e02ff91dc1</SHA-256>
              <SHA-1>9a4818897251cacb7fe1c6fe1be3e854985186ad</SHA-1>
              <MD5>c712515d052a385991d30b9c6afc767f</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/x-msdownload</file_type>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <SHA-256>fc7d6df80c403c5af7d9ad23b1f678389925c4268586edf2f5e1aace898105b5</SHA-256>
              <SHA-1>cb8ce33a069448e45c7403d35695568135296537</SHA-1>
              <MD5>d7a5278f50a7bf17ba9fc7d6b268a143</MD5>
              <origin>EXTRACTED_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>09768249679935ad777fa51279ae7d137f6d588ab0ed3a1648aba1d098457fda</SHA-256>
              <SHA-1>c9190c704e97df98e536cf470220b59d3a985be2</SHA-1>
              <MD5>23fa1590fa1b441d7a79c748b6a5b0ec</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>38dce98f573c21b24586dbf857dd2f0c38d6e82fc02f1d55d02e1729ac59f5db</SHA-256>
              <SHA-1>ae95e0fe33b303df50a98f4e8ecbf19c141251c6</SHA-1>
              <MD5>878f322c171021830aa30f617dd9c84a</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca</SHA-256>
              <SHA-1>48df0911f0484cbe2a8cdd5362140b63c41ee457</SHA-1>
              <MD5>0d7ad4f45dc6f5aa87f606d0331c6901</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-msdownload; format=pe</file_type>
            </value>
            <value>
              <SHA-256>49a60be4b95b6d30da355a0c124af82b35000bce8f24f957d1c09ead47544a1e</SHA-256>
              <SHA-1>bac45b86a9c48fc3756a46809c101570d349737d</SHA-1>
              <MD5>24d3b502e1846356b0263f945ddd5529</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>6f2f2ffcffec00ad4c1efc34d1f8fab482d46b2409e5acb205e96d68974a0eb9</SHA-256>
              <SHA-1>0b1448fe727e14f71e632407c205d1cc9a63e5ff</SHA-1>
              <MD5>8e690cbedf3db7fcba23353cc9dbeb2f</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-7z-compressed</file_type>
            </value>
            <value>
              <SHA-256>b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592</SHA-256>
              <SHA-1>36bd49ae21c460be5753a904b4501f1abca53508</SHA-1>
              <MD5>80e44ce4895304c6a3a831310fbf8cd0</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e</SHA-256>
              <SHA-1>3d49fc2784b9450962ed6b82b46e9c3c957d7c15</SHA-1>
              <MD5>c6a6e03f77c313b267498515488c5740</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>f45d39dc8ea7d1042953449fdeaa10e4419408618482053d05b08b90b143aeb7</SHA-256>
              <SHA-1>774655be9214f5756d4b30fe2a2b2fbe3724c735</SHA-1>
              <MD5>cdeae4ba50a558c6189c0aa9a4db5a15</MD5>
              <origin>INSTALLER_EXTRACTION</origin>
              <file_type>application/x-nsis-decompiled</file_type>
            </value>
          </files>
        </iocs>
        <name>Xeno-v1.3.60.exe</name>
        <report_id>a925b564-ed01-402d-83d5-1285357d27f1</report_id>
        <tags>
          <value>peexe</value>
          <value>packed</value>
          <value>anti-debug</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>installer</value>
          <value>expired-cert</value>
          <value>nsis</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>base64</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>830ea9f1d7bc7b7973f18390f19377da756c1ce30b285fff9eee8d32efa3a1ad</id>
    <title>Analysis Report for 830ea9f1d7bc7b7973f18390f19377da756c1ce30b285fff9eee8d32efa3a1ad</title>
    <updated>2026-08-20T21:17:55Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876f1ff2677ae4d366d474</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a876f00f72d6ce80a2723ad</flow_id>
        <hash>830ea9f1d7bc7b7973f18390f19377da756c1ce30b285fff9eee8d32efa3a1ad</hash>
        <iocs>
          <urls>
            <value>
              <url>https://services.telltalegames.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://services.telltalegames.com/1/syncfs/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>services.telltalegames.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>ftp@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>3.174.46.111</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>010c603f7c42659422070d028fd8125973a45c92d56e1b6802f02585fc0c5176</SHA-256>
              <SHA-1>a7b664ed6a45372f83b29fe49ecebb8057e43796</SHA-1>
              <MD5>8f595cef3ef7e6da5231ceaad3d48de2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>197a0e6282f84c3a8b1052986a11467ad0e49a95048c8cf69592574227f240b6</SHA-256>
              <SHA-1>ce6e4261c1a75e62ac8f0949f61a2f3d7d740ddc</SHA-1>
              <MD5>ef948ea976f3b1df94fde85b0c3b8154</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>372e1127ed0d65fe1b47bf1040d78c3d2f13f04e7a05558bf49a2fb8f86042bf</SHA-256>
              <SHA-1>4ed31140ec23f32d4812fef73c5ae8ad91dd0d7b</SHA-1>
              <MD5>5e8c790172dff011c91b68a66916ad61</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>4b4b6d8d7a469e299a904b67a21bac96437d3d253d54dbeee041b7ddad09b518</SHA-256>
              <SHA-1>986e4555f088bf74be0820df77747c6d0328500c</SHA-1>
              <MD5>04906373206fd0ffe1dfdb9c60b34f0a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>55ca4cc3bddfc1c0d2bc5e3050ba0694b027c4925c98da49a554ea33e02a15db</SHA-256>
              <SHA-1>2279fc2db9c3e07572bcb09cffcf53671873f387</SHA-1>
              <MD5>d1932bde7244452f6010f4d35df308a9</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>5ca59e0dbb068fc042024d0c5a75779221613dbb49afd5bbfdd6829b6707e902</SHA-256>
              <SHA-1>27393aebe4002d32c4a51095f113831eada85a16</SHA-1>
              <MD5>9b51aae5ea672ca0d51915772430448d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>5d5fe11c7e66a6fc1e9ccb7df92f13bc8e0843df97a9633cd490b9ee358f0336</SHA-256>
              <SHA-1>1c23a73cf0b001a884727fff1e6dedf2f0853b7e</SHA-1>
              <MD5>049af8bc5a1cac6c30f5bb2693937376</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>5dc6f9ecaa35c540ec560e1d09753cfac1863fca7b5d6b5753b24e19a3022bc9</SHA-256>
              <SHA-1>98fda5c32b0faccee5dcee28b659bc2252e2c6e1</SHA-1>
              <MD5>67f548de3f696da8d531edcb98317b95</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>7cee5edb8c1ceab29ec1a0b38298223f1c763aa01eb088f27f3d181a83a22f87</SHA-256>
              <SHA-1>caa26978d921fb11b0f38f486491cc1d2ac99c60</SHA-1>
              <MD5>ea4865d9ac74244e9f950ebc65b43384</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>8cfb2e463866d644e5b21930f0ea6c5e02b57262c298baf0369808a815cbb474</SHA-256>
              <SHA-1>8daa41114cb7c8885a605601ddc8225a020e10fa</SHA-1>
              <MD5>bed12c457195794233e8c652c35275fb</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>aee58bd956e7ad6ac22fa5ba57e28b0fad5488659e003160818beca483c66a94</SHA-256>
              <SHA-1>11425b3d7fd875461ed70f00a32e22d49e79fea5</SHA-1>
              <MD5>c9cafdc7936441b2780f250076f164d8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>c7aa466da90e3e8809397f12e34737f348da1959ada123762081acd30218f83d</SHA-256>
              <SHA-1>d4fcdc113af531c1fa58a2a1693cf4349ce111cf</SHA-1>
              <MD5>b87c7395e8f9890f7f02bad2038e100f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>d2340606b91da524650dc1e0f59caa7e5ea36e71271b059f71844bda3d6893af</SHA-256>
              <SHA-1>88773c004d49b204e389336905caa74c2ee29f91</SHA-1>
              <MD5>56ebf6e5124b9b424b9daae9e8616846</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>d54d7c640a5d8c50c1560774f5cc3f9422a741883f08290365fea1226797387e</SHA-256>
              <SHA-1>d1d547517f88a39fddfc8da9e2a8c4c1de8640c6</SHA-1>
              <MD5>2018da3d8665c91173ced88ed35d93bb</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>da3c523fad8444e6f41258073a1db2419865f526aff18d2fb776323727278f1b</SHA-256>
              <SHA-1>86fb0d27abccbfca52f26927507d8e3b380357b2</SHA-1>
              <MD5>39b78e5f5784a7752e2498a55e267364</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/json</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <registry>
            <value>
              <registry>SOFTWARE\Microsoft\Cryptography</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\App Paths\</registry>
              <origin>INPUT_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <registry>Software\Telltale Games\</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>System\CentralProcessor\0\</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>MinecraftStoryMode.exe</name>
        <report_id>cbceef4e-4cce-4741-bda8-c3413dbf8444</report_id>
        <tags>
          <value>peexe</value>
          <value>json</value>
          <value>anti-vm</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>evasive</value>
          <value>fingerprint</value>
          <value>keylogger</value>
          <value>packed</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>7bc1da73e77fc789b738401686b7963405cb923f8a429524cda08dda7864dfb2</id>
    <title>Analysis Report for 7bc1da73e77fc789b738401686b7963405cb923f8a429524cda08dda7864dfb2</title>
    <updated>2026-08-20T21:17:52Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876f5e49c2438a47b7299f</_id>
        <file_type>text/html</file_type>
        <flow_id>6a876efef72d6ce80a2723a9</flow_id>
        <hash>7bc1da73e77fc789b738401686b7963405cb923f8a429524cda08dda7864dfb2</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cmd-official.com/index.html</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://cmd-official.com/index.html</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>cmd-official.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>5.255.123.65</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxps://cmd-official.com/index.html</name>
        <report_id>0b37693f-aba1-4288-9456-f23ba8f32ad4</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>1da268eeadda80c2c55948c55d8e501bc8f58058b72460e2f6e7477dc6976365</id>
    <title>Analysis Report for 1da268eeadda80c2c55948c55d8e501bc8f58058b72460e2f6e7477dc6976365</title>
    <updated>2026-08-20T21:17:40Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876f39f2677ae4d366d47d</_id>
        <file_type>text/plain</file_type>
        <flow_id>6a876ef2f72d6ce80a27237a</flow_id>
        <hash>1da268eeadda80c2c55948c55d8e501bc8f58058b72460e2f6e7477dc6976365</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cmd-official.com/about</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://cmd-official.com/about</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://cmdnkiqjije2tllr3biee2sjgj3i4robg2cbtilbnytdhh2wy3syrlyd.onion</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://cmd-official.com/about</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cmdofficial.com</url>
              <origin>URL_RENDER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cmd-official.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>cmd-official.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cmdnkiqjije2tllr3biee2sjgj3i4robg2cbtilbnytdhh2wy3syrlyd.onion</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>cmdofficial.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cmd-official.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>5.255.123.65</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>5.255.123.65</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxps://cmd-official.com/about</name>
        <report_id>e9c4e118-50c2-4f31-81fe-25a0fedd8b1e</report_id>
        <tags>
          <value>txt</value>
          <value>tor</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>22369f3a921ce7b31606fc49256c39cbee065549eb53a3f9ecd0b6873dacaa84</id>
    <title>Analysis Report for 22369f3a921ce7b31606fc49256c39cbee065549eb53a3f9ecd0b6873dacaa84</title>
    <updated>2026-08-20T21:17:24Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876f1349c2438a47b72990</_id>
        <file_type>text/plain</file_type>
        <flow_id>6a876df5f72d6ce80a2720c0</flow_id>
        <hash>22369f3a921ce7b31606fc49256c39cbee065549eb53a3f9ecd0b6873dacaa84</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cmd-official.com/click/142</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://cmdamadqfukbyg4envbfkkjn66rrfcwd2rif3bebjrlfwzse2oj6u4ad.onion/CSk2RzwkzzQuM9L7GZI1/documents.zip</url>
              <origin>URL_RENDER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://cmd-official.com/click/142#buttons</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cmd-official.com/click/142</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cmd-official.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>cmd-official.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>cmd-official.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cmdamadqfukbyg4envbfkkjn66rrfcwd2rif3bebjrlfwzse2oj6u4ad.onion</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>5.255.123.65</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
        </iocs>
        <name>hxxps://cmd-official.com/click/142</name>
        <report_id>1d4eb01b-17b6-4c38-83ce-bf3a6c4612b1</report_id>
        <tags>
          <value>txt</value>
          <value>tor</value>
          <value>aidetect</value>
          <value>phishing</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>4418bd3c1c1ac2f170d457a831a570d92c7f8d3f52a08a090532f8f26d76ac76</id>
    <title>Analysis Report for 4418bd3c1c1ac2f170d457a831a570d92c7f8d3f52a08a090532f8f26d76ac76</title>
    <updated>2026-08-20T21:13:57Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876eb4f2677ae4d366d449</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a876e120dfb99c1ceb07a7f</flow_id>
        <hash>4418bd3c1c1ac2f170d457a831a570d92c7f8d3f52a08a090532f8f26d76ac76</hash>
        <iocs>
          <urls>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#%06%08+%06%01%05%05%070%01</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#%06%08+%06%01%05%05%070%01</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/SMI/2005/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/SMI/2016/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://adoptium.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.comodoca.com/AAACertificateServices.crl04</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertTrustedRootG4.crl0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://www.gnu.org/licenses/gpl.html</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://adoptium.net</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://jdownloader.org/download/index</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://sectigo.com/CPS0</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>adoptium.net</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>adoptium.net</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>cacerts.digicert.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl.comodoca.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crl.sectigo.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crl3.digicert.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>crt.sectigo.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>gnu.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>jdownloader.org</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>sectigo.com</url>
              <origin>EXTRACTED_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>crl3.digicert.com</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crt.sectigo.com</url>
              <origin>MALWARE_CONFIG</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>info@formdev.com0</email>
              <origin>EXTRACTED_FILE</origin>
            </value>
            <value>
              <email>i4j_extf_7_69g5ss_1u47b19@2x.png</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>i4j_extf_7_69g5ss_1u47b19@2x_dark.png</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>116.203.240.177</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.11.40.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>91.199.212.90</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>209.51.188.116</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.64.149.23</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.38.233</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.20.66</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>0f62ee49eee64a2996e33d44dc11208506193101eebb8b1ac7e85389248d8353</SHA-256>
              <SHA-1>ad07ecdb1b9cfbcd44ad703d723a5600ed68c4f2</SHA-1>
              <MD5>7e07d7ba5df2e4ec107941b0fd09a286</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>2652756a10e04dc2b9ba5186af3e757ebfbed04a9acdcf719713377efb1554fb</SHA-256>
              <SHA-1>89f079b42e5c33834d07b01a74d0018aee19a832</SHA-1>
              <MD5>c16c6ffb218ee9eabb018f3b0a03d103</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>28962966015ec881dea8b4de095d373a0b3b5c3ac45e5410fa4b5bea8283a10b</SHA-256>
              <SHA-1>23c0cfa3a4100770b5f2d0780104052075b5f749</SHA-1>
              <MD5>a4862ccc8f22254c07c9d43f2d10ae38</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>605cbdaa095e29d7046f2651564f1e965f999a4b470d30f0297b644791e04cb1</SHA-256>
              <SHA-1>55051eaf9cacbd5939460c1b412d4a8fa0ab6a10</SHA-1>
              <MD5>250b3691bf9c4ba40b2d586b9e283afd</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>641490802afb5e3085c1c633df8addf38891eb61bb0b58620c6008897d2bf861</SHA-256>
              <SHA-1>53438461d19fab780e45a2639422776066d3ac63</SHA-1>
              <MD5>4d30aeebcca0b1ee5b9b2524ab2ec76e</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>69ea26311b806ec163fbb30bc65fc0f405ab01edadd7cde2b43eaa4d0c2f6eaa</SHA-256>
              <SHA-1>a346c5eaa7fb58e501c97901af2d68a1faeec2f6</SHA-1>
              <MD5>be629db467a3c9ff81323fb7c17a1816</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>847fd84bb452a4f02bd89355fbba988cab28a68fed9255725890a1f3db636b64</SHA-256>
              <SHA-1>ce7405267f751ec0e9e8ac895f26592acbbf113b</SHA-1>
              <MD5>b68f77a5645bfdbb9790676548f18fd3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>94758470bcebc4b2481167f31f9d903efbe9d6afbca1a63c0d51177316eff417</SHA-256>
              <SHA-1>6bd225cc3b0bdb4a72d01faf87f7eac729fd565c</SHA-1>
              <MD5>53d0ceecbd0bfb0cfaec4421b6b23a2b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>94d061005af02b72898c46ab0c4c6ff0d4c2ecf2fb76d786b304ad16eba1dd54</SHA-256>
              <SHA-1>4e7189cea3a7d753b56621ff3702a239b94fcd27</SHA-1>
              <MD5>56edcff90e8d28d94b02c7a519f213c8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>9f48fda376923d2d23cd5db23dea052aed9f769f409a135a69f7d843235b6b5a</SHA-256>
              <SHA-1>c42c388a81b1d1e4f0ed8068ab76d33fa503cd89</SHA-1>
              <MD5>47f5359e9624322f6a1f3ef6c357479f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>a96bc3d11c95268275044c6740cefa503832eac3d85d80b181f1ccbc18293299</SHA-256>
              <SHA-1>ae182e1193658054d41a3e9c43fce77081430b16</SHA-1>
              <MD5>58b8405da1ef1af741f26140ccdf3c16</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>aaba2b1d5ea889eddb23a53af19e1987df7a1874ff700c756029aea0f36c90ac</SHA-256>
              <SHA-1>ce11eaec87b39a2d80eeffe79891cef7bbb69e35</SHA-1>
              <MD5>fc9de181592fa38f5034dcadb05370e5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>bd1966abe82adae145d59531a0fe73fe9c65649d8fafdc79a64615d0653e5b94</SHA-256>
              <SHA-1>10e4c6411964381dac844a8e333d9ab09966ad53</SHA-1>
              <MD5>1c2a6c8c1b62d4d0538a2e3c296259c6</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>c5f42c43240f10e6eb4db1c536bdc82e636d17eae0c17e5421801deef6558d3d</SHA-256>
              <SHA-1>a0e0fc5844f0211ee258024fd7673587f70769ab</SHA-1>
              <MD5>4d43faf336ecb595dccbfe4978a31baa</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>c83cd456e0fc10e6c1b86630f0977377d7b7d17ce7985af82158de56dbf1d4e6</SHA-256>
              <SHA-1>c1c692c5ce24fd265b89c09ac10c641e325f105e</SHA-1>
              <MD5>e04a7052fa7e700909f72572f04b6c23</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>cc08a1dafd848d90a012ab7ff3b8aa022f3f8b0b151ed7821e6f1a7819952a3f</SHA-256>
              <SHA-1>95242758aa68d5e2d9a0954fe9ebc8db14ad63eb</SHA-1>
              <MD5>93c3a95143a83f5d1fc2ae1c1135b331</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>ddbc3192e42236555ae7af9631b1942f2ab143e4545f404b9fcca1b71ab0a19c</SHA-256>
              <SHA-1>918ff0ee049ddc1b211db6231a5e01e9dec4dddf</SHA-1>
              <MD5>142898f32c8d8534c216fd5f2fdfee85</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>f2347a4fcf5f5a23837351e09da2a078be5de4b3e5a8027a710e71ac3a333acf</SHA-256>
              <SHA-1>8166f1138dc8201e2278175a3a14963bf7ef1d07</SHA-1>
              <MD5>12800dee7a323c82ac42588275e4b07f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>fbea441f66395a88dcdb4723a1c1af7347f2d661b3274ea23713cb034e8a88ae</SHA-256>
              <SHA-1>70c9091c50ddc09135a4fee082292598bd28b6b4</SHA-1>
              <MD5>4def4b953b5dcc72556edec43d8e2f4a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>fe0d30328525d30c94a9d9f19103330f0da28ba07b2299d88fd8d947713dfaec</SHA-256>
              <SHA-1>27640280e8c185928b3e795c3dbb3d90c37aab4d</SHA-1>
              <MD5>0705d3b83a79d95f1feadf8e485ccb63</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>547e6645bc3c498aa37b244e1c0f702f4b579a18d7377203029b28d9e084b594</SHA-256>
              <SHA-1>a1a0a07fc1a82aff6e45b60bb64c6b60516795e4</SHA-1>
              <MD5>515676212ec5ea2363a1b41302022a6c</MD5>
              <origin>MALWARE_CONFIG</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>e8d1b3aeffd02b30fe00bbf7bfb873c3b8c099f00dbd2e6cb4871954e46cee61</SHA-256>
              <SHA-1>b9e86e95a7344a4a60895d8837cc488c714c4185</SHA-1>
              <MD5>04cd53734c60e9f3d828dc368c2e6472</MD5>
              <origin>MALWARE_CONFIG</origin>
              <file_type>application/x-msdownload</file_type>
            </value>
            <value>
              <SHA-256>2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e</SHA-256>
              <SHA-1>80c9820ff2efe8aa3d361df7011ae6eee35ec4f0</SHA-1>
              <MD5>4842e206e4cfff2954901467ad54169e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/octet-stream</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>3da5d8ccec42c4c4061c9989c4b50ddf5268a3c71652dfac75dca723741a54d1</SHA-256>
              <SHA-1>14d0de43c53a919ca7b170ca857e5d996bafa74b</SHA-1>
              <MD5>52b596215d35a842c693ab7bffbcae19</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>SOFTWARE\Azul Systems\Zulu</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\Eclipse Adoptium\JDK</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\Eclipse Adoptium\JRE</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\JavaSoft\JDK</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\JavaSoft\JRE</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\JavaSoft\Java Development Kit</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\JavaSoft\Java Runtime Environment</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\Microsoft\JDK</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\ej-technologies\exe4j\</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\ej-technologies\exe4j\jvms2\</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\ej-technologies\exe4j\locatedjvms\</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\ej-technologies\exe4j\pids\</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\ej-technologies\install4j\</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\ej-technologies\install4j\installations</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Themes\Personalize</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>JDownloader2Setup_windows-amd64_v21_0_10.exe</name>
        <report_id>9b60d4a4-4de8-48c5-9a6d-734503f8ff77</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>data</value>
          <value>xor-pe</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>cmd</value>
          <value>lolbin</value>
          <value>packed</value>
          <value>explorer</value>
          <value>fingerprint</value>
          <value>overlay</value>
          <value>obfuscated</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9fe2d98db6cef82a6b817fa79b62f0268478898b55d1b0d61fd37c902f109b36</id>
    <title>Analysis Report for 9fe2d98db6cef82a6b817fa79b62f0268478898b55d1b0d61fd37c902f109b36</title>
    <updated>2026-08-20T21:13:32Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876e63a7edcf8232f85c16</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a876dfa099a97c449ef443c</flow_id>
        <hash>9fe2d98db6cef82a6b817fa79b62f0268478898b55d1b0d61fd37c902f109b36</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schemas.microsoft.com/SMI/2016/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>05d8325a65011f2d583e25e2dccbfb39633d50bf2baa71dc4e3dbb471bdd4e14</SHA-256>
              <SHA-1>6b08d7a25d38ea166614303c64542712d74f9f47</SHA-1>
              <MD5>2bedb9e2f42f33eb834506449f15ecc2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>335672c72d58b12d70e81f1c119bf1798e0070928ee87c403f24ab060403e72e</SHA-256>
              <SHA-1>d570ac109173a38bd333097a30227c31c97dd4f0</SHA-1>
              <MD5>8fe4b9f6c0f51517a6eacaff2c45161c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>6180feb0d47040f9cdf452c221481434196eebb885f46aea60f8e1c3055d3dee</SHA-256>
              <SHA-1>8e4838b2153cfa745e9f0106f9d433e98ac4c9fb</SHA-1>
              <MD5>37d6d06ec8c37655892b40e4dd8034be</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>69e3cce41758187e0d60deac0d57f675904686106ce49a345c5bdb61ed608d01</SHA-256>
              <SHA-1>f33b1005e31bb6e783712ee0b755051bfc03ad7d</SHA-1>
              <MD5>8785a1ae7b4c6879b7e99b5630a5f695</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>72b535db2e5b8436d4812edfcfbc1d4670883067546c83a4bdc1da2ed9bf3ed5</SHA-256>
              <SHA-1>cce77e9d4af355915c650a35018466f9f93a147e</SHA-1>
              <MD5>81ecf2107829fd8d38e1c87b318ed0bc</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>86773d4ac3cbc05f358ad3d4cf780be03189a8d05ccbc805ae53618c96c411e4</SHA-256>
              <SHA-1>da14329e93eac6e71bcf854cf2d6ab9e8c0bf44f</SHA-1>
              <MD5>a2dec93a6fce5d216602715bb4353054</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>abf8f2022f12f350789d961aceaf9ccfd53e7ec58d8c9934cfce77779b4eac11</SHA-256>
              <SHA-1>5f8991f3e065fd95614859a293f88b9c70e4bb23</SHA-1>
              <MD5>84da8dee6b319ea0b10b6de5489c6aae</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>b2a0202aaff5f7b6867509825942b4f4d4870bafe0cd2e00f7047d3f8966fb42</SHA-256>
              <SHA-1>9a2e863e544885561908aeebb5da95580103db08</SHA-1>
              <MD5>30af9e177ae02c2cb6ac1ae0f164e4ba</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>c0a2a45ff4f6dbe9e0752c787bb2d6353e1d2020091bd633fd39b878f8651b2a</SHA-256>
              <SHA-1>6712f1f36f6581df1d4fb8327e3aa0e9253006c2</SHA-1>
              <MD5>8608902eaeb4bd8fc66e40d0a2d0c38f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/zlib</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1f676c76-80e1-4239-95bb-83d0f6d0da78</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>35138b9a-5d96-4fbd-8e2d-a2440225f93a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>e2011457-1546-43c5-a5fe-008deee3d3f0</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>9fe2d98db6cef82a6b817fa79b62f0268478898b55d1b0d61fd37c902f109b36.exe</name>
        <report_id>e8231c15-9106-4787-b48b-d58d1f18f24b</report_id>
        <tags>
          <value>peexe</value>
          <value>dropper</value>
          <value>adaptive-context</value>
          <value>expand</value>
          <value>lolbin</value>
          <value>packed</value>
          <value>reconnaissance</value>
          <value>overlay</value>
          <value>microsoft_visual_cc</value>
          <value>pyinstaller</value>
          <value>anti-debug</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a1f71e3bf23ae3af104a41d513eb5ead25ce7fefb2f825478f100b637173462a</id>
    <title>Analysis Report for a1f71e3bf23ae3af104a41d513eb5ead25ce7fefb2f825478f100b637173462a</title>
    <updated>2026-08-20T21:13:26Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876e69a7edcf8232f85c19</_id>
        <file_type>application/x-msdownload; format=pe64</file_type>
        <flow_id>6a876df50dfb99c1ceb079f8</flow_id>
        <hash>a1f71e3bf23ae3af104a41d513eb5ead25ce7fefb2f825478f100b637173462a</hash>
        <iocs>
          <btc_wallets>
            <value>
              <btc_wallet>39a6e11bbf53ad8815af36b89c5eda15</btc_wallet>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>a1f71e3bf23ae3af104a41d513eb5ead25ce7fefb2f825478f100b637173462a.exe</name>
        <report_id>ee2a9261-dfe0-428a-8ded-2589e7650723</report_id>
        <tags>
          <value>peexe</value>
          <value>bloated</value>
          <value>overlay</value>
          <value>packed</value>
          <value>crypto</value>
          <value>golang</value>
          <value>base64</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>4b6a8aad9ce6294b03bbacbceee98c682050067bc9b11ed08366df040e247aee</id>
    <title>Analysis Report for 4b6a8aad9ce6294b03bbacbceee98c682050067bc9b11ed08366df040e247aee</title>
    <updated>2026-08-20T21:13:11Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876e47b4681b3ab7ee45c2</_id>
        <file_type>text/plain</file_type>
        <flow_id>6a876de7f72d6ce80a272096</flow_id>
        <hash>4b6a8aad9ce6294b03bbacbceee98c682050067bc9b11ed08366df040e247aee</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cmd-official.com/click/139</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://cmd-official.com/click/139</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://cmdamadqfukbyg4envbfkkjn66rrfcwd2rif3bebjrlfwzse2oj6u4ad.onion/KRQVuH4rwZGLieA1Dj3z/tree.zip</url>
              <origin>URL_RENDER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://cmd-official.com/click/139#buttons</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>cmd-official.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>cmd-official.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cmdamadqfukbyg4envbfkkjn66rrfcwd2rif3bebjrlfwzse2oj6u4ad.onion</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>cmd-official.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>5.255.123.65</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
        </iocs>
        <name>hxxps://cmd-official.com/click/139</name>
        <report_id>ca71d067-f50e-414d-a73a-affc691616e8</report_id>
        <tags>
          <value>txt</value>
          <value>tor</value>
          <value>aidetect</value>
          <value>phishing</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f88e7e8d345d5af6846369e23972d99fb40f94547a0f7c387f7d950a0346a44a</id>
    <title>Analysis Report for f88e7e8d345d5af6846369e23972d99fb40f94547a0f7c387f7d950a0346a44a</title>
    <updated>2026-08-20T21:12:53Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876e7e49c2438a47b72976</_id>
        <file_type>text/plain</file_type>
        <flow_id>6a876dd20dfb99c1ceb0795a</flow_id>
        <hash>f88e7e8d345d5af6846369e23972d99fb40f94547a0f7c387f7d950a0346a44a</hash>
        <iocs>
          <urls>
            <value>
              <url>https://5.255.123.65/</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://cmdnkiqjije2tllr3biee2sjgj3i4robg2cbtilbnytdhh2wy3syrlyd.onion</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://5.255.123.65/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://5.255.123.65/#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cmdofficial.com</url>
              <origin>URL_RENDER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>https://stewartbellandassociates.ca</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.binance.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.coinbase.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.contactgroup.com.au</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.kraken.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.medlinkga.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:cmd2official@onionmail.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:cmdhtmnjksgkuhilrtrh@onionmail.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://5.255.123.65/</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cmdnkiqjije2tllr3biee2sjgj3i4robg2cbtilbnytdhh2wy3syrlyd.onion</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>cmdofficial.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>stewartbellandassociates.ca</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.binance.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.coinbase.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.contactgroup.com.au</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.kraken.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.medlinkga.org</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>5.255.123.65</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>5.255.123.65</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>5.255.123.65</ip>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
        </iocs>
        <name>hxxps://5.255.123.65/</name>
        <report_id>db09abfa-471c-4157-9cfa-af73afdae5ab</report_id>
        <tags>
          <value>txt</value>
          <value>tor</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>b392c969aacf78c27c8316fa3ee1b09da0a8e16ae2aac91e812a2b71d9453e23</id>
    <title>Analysis Report for b392c969aacf78c27c8316fa3ee1b09da0a8e16ae2aac91e812a2b71d9453e23</title>
    <updated>2026-08-20T21:12:41Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876e42f2677ae4d366d41f</_id>
        <file_type>text/plain</file_type>
        <flow_id>6a876dc6f72d6ce80a272035</flow_id>
        <hash>b392c969aacf78c27c8316fa3ee1b09da0a8e16ae2aac91e812a2b71d9453e23</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cmd-official.com/click/136</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://cmdamadqfukbyg4envbfkkjn66rrfcwd2rif3bebjrlfwzse2oj6u4ad.onion/BGUiRyyYzCgkBv3vfl2R/documents.zip</url>
              <origin>URL_RENDER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://cmd-official.com/click/136#buttons</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cmd-official.com/click/136</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cmd-official.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>cmd-official.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>cmd-official.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cmdamadqfukbyg4envbfkkjn66rrfcwd2rif3bebjrlfwzse2oj6u4ad.onion</url>
              <origin>URL_RENDER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>5.255.123.65</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
        </iocs>
        <name>hxxps://cmd-official.com/click/136</name>
        <report_id>9124f3cd-3295-409a-a194-6761d88315c5</report_id>
        <tags>
          <value>txt</value>
          <value>tor</value>
          <value>aidetect</value>
          <value>phishing</value>
        </tags>
        <verdict>LIKELY_MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>42639b2e5507163d35069be166e37a784f48a5f17e3577c16eb48fab215247cd</id>
    <title>Analysis Report for 42639b2e5507163d35069be166e37a784f48a5f17e3577c16eb48fab215247cd</title>
    <updated>2026-08-20T21:11:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876ef7f2677ae4d366d468</_id>
        <file_type>text/plain</file_type>
        <flow_id>6a876d7cf72d6ce80a271f5c</flow_id>
        <hash>42639b2e5507163d35069be166e37a784f48a5f17e3577c16eb48fab215247cd</hash>
        <iocs/>
        <name>BSD-3-Clause.txt</name>
        <report_id>8fa02320-ab90-4a25-93fc-b1cfb70c8005</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>695114256e306a5e1ca407bc6e2a11877b112328dbe990253b52f59726e01b4b</id>
    <title>Analysis Report for 695114256e306a5e1ca407bc6e2a11877b112328dbe990253b52f59726e01b4b</title>
    <updated>2026-08-20T21:11:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876d8cf2677ae4d366d3e8</_id>
        <file_type>text/x-ini</file_type>
        <flow_id>6a876d7cf72d6ce80a271f5c</flow_id>
        <hash>695114256e306a5e1ca407bc6e2a11877b112328dbe990253b52f59726e01b4b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://spdx.dev/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://spdx.dev/</url>
              <origin>CONTENT_PARSE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>spdx.dev</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>spdx.dev</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>23.185.0.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>ba03e307783395b493f3e4fbb72201800567dce0be1d7710851afe3a5d48d5cd</SHA-256>
              <SHA-1>69f9d07a2346e068b43bb3ab70cc57eec4641a8e</SHA-1>
              <MD5>68c73abb099daa9b2af1a0089ab565fb</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>COPYING</name>
        <report_id>1e483f04-bed5-4212-b89a-08222a2864f9</report_id>
        <tags>
          <value>html</value>
          <value>txt</value>
          <value>ini</value>
          <value>anti-vm</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>f7c772caea23f85cfb5629cfee9954ce8977814eef8b183eaaa3c28f66e6a839</id>
    <title>Analysis Report for f7c772caea23f85cfb5629cfee9954ce8977814eef8b183eaaa3c28f66e6a839</title>
    <updated>2026-08-20T21:11:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876e10f2677ae4d366d40f</_id>
        <file_type>text/plain</file_type>
        <flow_id>6a876d7cf72d6ce80a271f5c</flow_id>
        <hash>f7c772caea23f85cfb5629cfee9954ce8977814eef8b183eaaa3c28f66e6a839</hash>
        <iocs>
          <urls>
            <value>
              <url>https://aka.ms/vs/17/release/vc_redist.x64.exe</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://aka.ms/vs/17/release/vc_redist.x64.exe</url>
              <origin>INPUT_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>aka.ms</url>
              <origin>INPUT_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>aka.ms</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>23.52.181.141</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>705cf150e9f59bc05ac40d37f83db6b6403c6a9cdb47f6b1e50b09b99b094b53</SHA-256>
              <SHA-1>4ffc80e2c9c9059712f1ffca2ade51453dc59ae8</SHA-1>
              <MD5>5d845bf721d9d5c368ebbd161f02c7c2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
              <verdict>LIKELY_MALICIOUS</verdict>
            </value>
          </files>
        </iocs>
        <name>build_info.txt</name>
        <report_id>9183f9c4-cd75-4e41-adbf-4a748658fd44</report_id>
        <tags>
          <value>peexe</value>
          <value>txt</value>
          <value>anti-debug</value>
          <value>expand</value>
          <value>lolbin</value>
          <value>runonce</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>aaf135472f81c5b4a0dca9367e5bb5e9750032b5bebe5442b36e4c0a47430df3</id>
    <title>Analysis Report for aaf135472f81c5b4a0dca9367e5bb5e9750032b5bebe5442b36e4c0a47430df3</title>
    <updated>2026-08-20T21:11:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876ef3f2677ae4d366d463</_id>
        <file_type>text/plain</file_type>
        <flow_id>6a876d7cf72d6ce80a271f5c</flow_id>
        <hash>aaf135472f81c5b4a0dca9367e5bb5e9750032b5bebe5442b36e4c0a47430df3</hash>
        <iocs/>
        <name>GPL-2.0-or-later.txt</name>
        <report_id>9c8c7426-4655-4f38-b8c8-12921913f5b6</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>a2010f343487d3f7618affe54f789f5487602331c0a8d03f49e9a7c547cf0499</id>
    <title>Analysis Report for a2010f343487d3f7618affe54f789f5487602331c0a8d03f49e9a7c547cf0499</title>
    <updated>2026-08-20T21:11:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876ef5f2677ae4d366d466</_id>
        <file_type>text/plain</file_type>
        <flow_id>6a876d7cf72d6ce80a271f5c</flow_id>
        <hash>a2010f343487d3f7618affe54f789f5487602331c0a8d03f49e9a7c547cf0499</hash>
        <iocs/>
        <name>CC0-1.0.txt</name>
        <report_id>c7b4b0d0-5fa5-462c-9c6d-7ed1138e778f</report_id>
        <tags>
          <value>txt</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>67ae3e6a62301b5f348c026e112100cc44019e4266c0fe50e25fd5468bcfd879</id>
    <title>Analysis Report for 67ae3e6a62301b5f348c026e112100cc44019e4266c0fe50e25fd5468bcfd879</title>
    <updated>2026-08-20T21:11:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876ecef2677ae4d366d454</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a876d7cf72d6ce80a271f5c</flow_id>
        <hash>67ae3e6a62301b5f348c026e112100cc44019e4266c0fe50e25fd5468bcfd879</hash>
        <iocs>
          <urls>
            <value>
              <url>https://doc.qt.io/qt-6/highdpi.html#configuring-windows)</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>doc.qt.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>54.74.136.134</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>49a60be4b95b6d30da355a0c124af82b35000bce8f24f957d1c09ead47544a1e</SHA-256>
              <SHA-1>bac45b86a9c48fc3756a46809c101570d349737d</SHA-1>
              <MD5>24d3b502e1846356b0263f945ddd5529</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>e903775a90f393440f8717cf9639d7dde994a6be5b8a8a6b8ff841a20335cc5d</SHA-256>
              <SHA-1>73459c8d7185160f7a184ee9d3610ee550199ecb</SHA-1>
              <MD5>497046a8d8792dee50cd691e703322fc</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>a745745ac4e260275ac52c94f915eb07ec9cbbe6f137997761957f83f7bf075e</SHA-256>
              <SHA-1>f5980b7867b2d9cf7fbf686c76e556930bea602d</SHA-1>
              <MD5>6529538df0afec90428822e7489e5dca</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <registry>
            <value>
              <registry>HKLM\SOFTWARE\Microsoft\Avalon.Graphics\DISPLAY1</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>HKLM\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Themes\Personalize</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\Shell\Associations\UrlAssociations\mailto\UserChoice</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
          <btc_wallets>
            <value>
              <btc_wallet>xaf41a:$btc: 1QWindowsDirectWriteFontDatabas</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>xb0c48:$btc: 1QWindowsGuiEventDispatche</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>xb9500:$btc: 1QWinRTFactoryCacheRegistratio</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>qdirect2d.dll</name>
        <report_id>1f76755b-1f95-4d1a-968e-55a722f68ba1</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>pedll</value>
          <value>fingerprint</value>
          <value>microsoft_visual_cc</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>keylogger</value>
          <value>reconnaissance</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>6a90bd2bccb77f736745c76a1c5a29845e261925b1914d5bf8c6da633cdb715b</id>
    <title>Analysis Report for 6a90bd2bccb77f736745c76a1c5a29845e261925b1914d5bf8c6da633cdb715b</title>
    <updated>2026-08-20T21:11:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876edaf2677ae4d366d459</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a876d7cf72d6ce80a271f5c</flow_id>
        <hash>6a90bd2bccb77f736745c76a1c5a29845e261925b1914d5bf8c6da633cdb715b</hash>
        <iocs>
          <urls>
            <value>
              <url>https://doc.qt.io/qt-6/highdpi.html#configuring-windows)</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>doc.qt.io</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>54.74.136.134</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>49a60be4b95b6d30da355a0c124af82b35000bce8f24f957d1c09ead47544a1e</SHA-256>
              <SHA-1>bac45b86a9c48fc3756a46809c101570d349737d</SHA-1>
              <MD5>24d3b502e1846356b0263f945ddd5529</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>7ebbe695d28adeafc6862d267330ada55ce92cf8812aaf4c9d65f616809e8926</SHA-256>
              <SHA-1>3121fff7d798d841fa7ff9c08ab0418d88bf9837</SHA-1>
              <MD5>ae3b7bca84e62b5827f7234b14f2e3ff</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>a745745ac4e260275ac52c94f915eb07ec9cbbe6f137997761957f83f7bf075e</SHA-256>
              <SHA-1>f5980b7867b2d9cf7fbf686c76e556930bea602d</SHA-1>
              <MD5>6529538df0afec90428822e7489e5dca</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <registry>
            <value>
              <registry>HKLM\SOFTWARE\Microsoft\Avalon.Graphics\DISPLAY1</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\CurrentVersion\Themes\Personalize</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>Software\Microsoft\Windows\Shell\Associations\UrlAssociations\mailto\UserChoice</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
          <btc_wallets>
            <value>
              <btc_wallet>xa0ace:$btc: 1QWindowsDirectWriteFontDatabas</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>xa22e6:$btc: 1QWindowsGuiEventDispatche</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>xa89d0:$btc: 1QWinRTFactoryCacheRegistratio</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>qwindows.dll</name>
        <report_id>93a61152-4340-4000-a179-06e6ec7ad716</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>pedll</value>
          <value>fingerprint</value>
          <value>microsoft_visual_cc</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>keylogger</value>
          <value>reconnaissance</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>0c735b74d8ad91a99ce8d1405979f8f4d114c3372d5c40ab2d0687b6b2664f9b</id>
    <title>Analysis Report for 0c735b74d8ad91a99ce8d1405979f8f4d114c3372d5c40ab2d0687b6b2664f9b</title>
    <updated>2026-08-20T21:11:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876ee7f2677ae4d366d45e</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a876d7cf72d6ce80a271f5c</flow_id>
        <hash>0c735b74d8ad91a99ce8d1405979f8f4d114c3372d5c40ab2d0687b6b2664f9b</hash>
        <iocs>
          <ips>
            <value>
              <ip>6.5.1.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>49a60be4b95b6d30da355a0c124af82b35000bce8f24f957d1c09ead47544a1e</SHA-256>
              <SHA-1>bac45b86a9c48fc3756a46809c101570d349737d</SHA-1>
              <MD5>24d3b502e1846356b0263f945ddd5529</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>e9a1950355bd19027a62a4586c21f2abb48d3618fcbc9e26b84b24825127b435</SHA-256>
              <SHA-1>8333445a6562529e837485e012f671e3a6846a0c</SHA-1>
              <MD5>f550575430ce3f8eb6d375caa4a20cd7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>qsvgicon.dll</name>
        <report_id>755878b2-9c77-473b-ad39-2fd98b34e401</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>anti-debug</value>
          <value>anti-vm</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>21cc245c29b673e49e7fc7c606510aed4eeb52cd92668288997d89409914825a</id>
    <title>Analysis Report for 21cc245c29b673e49e7fc7c606510aed4eeb52cd92668288997d89409914825a</title>
    <updated>2026-08-20T21:11:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876e98f2677ae4d366d43b</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a876d7cf72d6ce80a271f5c</flow_id>
        <hash>21cc245c29b673e49e7fc7c606510aed4eeb52cd92668288997d89409914825a</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>49a60be4b95b6d30da355a0c124af82b35000bce8f24f957d1c09ead47544a1e</SHA-256>
              <SHA-1>bac45b86a9c48fc3756a46809c101570d349737d</SHA-1>
              <MD5>24d3b502e1846356b0263f945ddd5529</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>8deb8113ddbcdd11f0b402287db73a8f822419e2bd248852d115e0a39d7315c9</SHA-256>
              <SHA-1>c2831d7d9435cff2212e9b9d01938e77994375af</SHA-1>
              <MD5>5adaa73eff93d96e9e26193ebbd04e93</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
          <registry>
            <value>
              <registry>SOFTWARE\Microsoft\Cryptography</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\Microsoft\Windows NT\CurrentVersion</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
          <btc_wallets>
            <value>
              <btc_wallet>x4d26bf:$btc: 1QAbstractEventDispatcherPrivat</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x4d2c6d:$btc: 1QDynamicPropertyChangeEven</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x4d2ce3:$btc: 1QEventDispatcherWin32Privat</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x4d30f3:$btc: 1QMessageAuthenticationCod</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x4d393b:$btc: 1QWinRTFactoryCacheRegistratio</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x510d35:$btc: 1UQPropertyBindingFunctio</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>Qt6Core.dll</name>
        <report_id>7758cbf4-5ce5-4623-9ed7-f28821421ef2</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>base64</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>afb9b6d440aa36ca55951c13cd912a17ff9f2ba0fa9d4254351d40dff3826018</id>
    <title>Analysis Report for afb9b6d440aa36ca55951c13cd912a17ff9f2ba0fa9d4254351d40dff3826018</title>
    <updated>2026-08-20T21:11:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876ea5f2677ae4d366d441</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a876d7cf72d6ce80a271f5c</flow_id>
        <hash>afb9b6d440aa36ca55951c13cd912a17ff9f2ba0fa9d4254351d40dff3826018</hash>
        <iocs>
          <emails>
            <value>
              <email>toolbar-ext-macstyle@2x.png</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <files>
            <value>
              <SHA-256>49a60be4b95b6d30da355a0c124af82b35000bce8f24f957d1c09ead47544a1e</SHA-256>
              <SHA-1>bac45b86a9c48fc3756a46809c101570d349737d</SHA-1>
              <MD5>24d3b502e1846356b0263f945ddd5529</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>da5febaff76bb930233a6ce5fef02dee6122a508b99903f80dbec942c2fe653d</SHA-256>
              <SHA-1>9991519990f41c2f6673bc3d72c8a9771d02605e</SHA-1>
              <MD5>156aee0e77034fb18e3972f83694be94</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>x439b22:$btc: 333333339388777558577567c</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x4e2a77:$btc: 1QComboBoxPrivateContaine</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x4e2e09:$btc: 1QGraphicsDropShadowEffec</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x4e30fb:$btc: 1QGraphicsSceneContextMenuEven</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x4e3126:$btc: 1QGraphicsSceneDragDropEven</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x4e3200:$btc: 1QGraphicsSceneResizeEven</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x4e3e54:$btc: 1QTouchEventWidgetSequenc</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x55b96a:$btc: 1QAbstractTextDocumentLayou</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>Qt6Widgets.dll</name>
        <report_id>dd8b21a8-a07d-404d-baa2-05397026ce62</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ebe3a06f93ff8f5fa1336fdefb009105ca23ef875920a60a4dbc0d5af60bf3f4</id>
    <title>Analysis Report for ebe3a06f93ff8f5fa1336fdefb009105ca23ef875920a60a4dbc0d5af60bf3f4</title>
    <updated>2026-08-20T21:11:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876eb2f2677ae4d366d447</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a876d7cf72d6ce80a271f5c</flow_id>
        <hash>ebe3a06f93ff8f5fa1336fdefb009105ca23ef875920a60a4dbc0d5af60bf3f4</hash>
        <iocs>
          <ips>
            <value>
              <ip>6.5.1.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>49a60be4b95b6d30da355a0c124af82b35000bce8f24f957d1c09ead47544a1e</SHA-256>
              <SHA-1>bac45b86a9c48fc3756a46809c101570d349737d</SHA-1>
              <MD5>24d3b502e1846356b0263f945ddd5529</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>ff2118c9bfd535a8f7dc7ad6b6e8be65190cd08b1cb602a1e43161d220932877</SHA-256>
              <SHA-1>7551e4ac5c39a8e585f621d4f2c714d2dade8360</SHA-1>
              <MD5>9426e5c53114fc1aace2dcd8f27fc0f7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>qsvg.dll</name>
        <report_id>21287361-0219-4d08-9daf-e1e40bc5bbc0</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>anti-debug</value>
          <value>anti-vm</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>650723e3165d68dbf82e56e779c873b2bf337d8c61e17cc1b8d35e7cb0ff0125</id>
    <title>Analysis Report for 650723e3165d68dbf82e56e779c873b2bf337d8c61e17cc1b8d35e7cb0ff0125</title>
    <updated>2026-08-20T21:11:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876ec0f2677ae4d366d44f</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a876d7cf72d6ce80a271f5c</flow_id>
        <hash>650723e3165d68dbf82e56e779c873b2bf337d8c61e17cc1b8d35e7cb0ff0125</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>49a60be4b95b6d30da355a0c124af82b35000bce8f24f957d1c09ead47544a1e</SHA-256>
              <SHA-1>bac45b86a9c48fc3756a46809c101570d349737d</SHA-1>
              <MD5>24d3b502e1846356b0263f945ddd5529</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>55c375b028f7781792751dc0d1075bc92b9b05a4a8e552c34a394080e8de01a6</SHA-256>
              <SHA-1>6fbfee4290091e3071e2ad5d75dd18d6a1b05bd9</SHA-1>
              <MD5>c388940ce1d4ffd5ad8a544bcbb2832f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>qwindowsvistastyle.dll</name>
        <report_id>ffaa7388-b382-4aa8-a609-afd77706348a</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
          <value>anti-vm</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>3f348ab32e036d0f97592177dda1f00f6f54e17f04466394f81196d4bb1efea9</id>
    <title>Analysis Report for 3f348ab32e036d0f97592177dda1f00f6f54e17f04466394f81196d4bb1efea9</title>
    <updated>2026-08-20T21:11:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876da1f2677ae4d366d3f0</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a876d7cf72d6ce80a271f5c</flow_id>
        <hash>3f348ab32e036d0f97592177dda1f00f6f54e17f04466394f81196d4bb1efea9</hash>
        <iocs>
          <urls>
            <value>
              <url>http://schemas.microsoft.com/SMI/2005/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://schemas.microsoft.com/SMI/2016/WindowsSettings</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://aka.ms/vs/17/release/vc_redist.x64.exe</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://curl.se/docs/alt-svc.html</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://curl.se/docs/hsts.html</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://curl.se/docs/http-cookies.html</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>aka.ms</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>curl.se</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>schemas.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <emails>
            <value>
              <email>ftp@example.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>151.101.193.91</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.52.181.141</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>045.3.0.1</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>045.4.3.1</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>045.4.3.2</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>045.4.3.3</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>045.4.3.4</ip>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <ip>1.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>1.3.14.3</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>40.1.101.3</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>49.1.1.1</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>49.1.1.10</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>49.1.1.11</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>49.1.1.12</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>49.1.1.13</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>49.1.1.14</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>49.1.1.2</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>49.1.1.4</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>49.1.1.5</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>49.1.9.1</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>49.1.9.2</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>6.0.0.0</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>eab5b0ab6840f3a6dca62e61fc4030cd92480c466632674598c9a2e912ffa27d</SHA-256>
              <SHA-1>3b2ca691c2b4c61a438b0f48012367f1f1f71d65</SHA-1>
              <MD5>a6fd9774989a1eb509451de4e5d8d09b</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/xml</file_type>
            </value>
            <value>
              <SHA-256>579bd87ad839d88a29830ecbd9290d5a91020e668e9164fc1a46e2e2ae49059a</SHA-256>
              <SHA-1>8d8c91edc9ed26e4c9bc0ddf997378867ffc28cd</SHA-1>
              <MD5>2f855660cdd3aafb0d2c53a2c6dbdc6d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>26d51875b9bd72680aae69a2f44d09d720a13a66d7f4f2ae08ae852b4c168f8e</SHA-256>
              <SHA-1>a8fde966ca94f64fe3afcf90c2183b24e47a7426</SHA-1>
              <MD5>51cd58b2a037553842b16afab3054c39</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>c202d81f7b37d049e3aaa7b9e3ef781cb0658bbc5cf89716f2b213278442c59a</SHA-256>
              <SHA-1>17669a56eba417a8bb452905d496938c6d72066d</SHA-1>
              <MD5>5521411f7ce845dbb1eaf1ada5765631</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>8363a41d73db85efb88e54b3cdfc2d63ce5e0254065bf19493aa15b394e71989</SHA-256>
              <SHA-1>51189f77847c8b96d008a84da037e679987b8a1d</SHA-1>
              <MD5>e1755d3c8ee9ebd8ab2f4a578e4af84a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>application/x-dosexec</file_type>
              <verdict>LIKELY_MALICIOUS</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
          <registry>
            <value>
              <registry>SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64</registry>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <registry>SOFTWARE\Microsoft\Windows NT\CurrentVersion</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>Updater.exe</name>
        <report_id>a6ddde02-7324-4850-911c-4b6620dc0670</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>anti-debug</value>
          <value>explorer</value>
          <value>crypto</value>
          <value>fingerprint</value>
          <value>reconnaissance</value>
          <value>expand</value>
          <value>lolbin</value>
          <value>runonce</value>
          <value>microsoft_visual_cc</value>
          <value>installer-heuristic</value>
          <value>base64</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>fb3eacd5c99a9de5b51ddb676c9c02675640164cc23432f7c24356d04a2ad108</id>
    <title>Analysis Report for fb3eacd5c99a9de5b51ddb676c9c02675640164cc23432f7c24356d04a2ad108</title>
    <updated>2026-08-20T21:11:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876e8af2677ae4d366d436</_id>
        <file_type>application/x-msdownload</file_type>
        <flow_id>6a876d7cf72d6ce80a271f5c</flow_id>
        <hash>fb3eacd5c99a9de5b51ddb676c9c02675640164cc23432f7c24356d04a2ad108</hash>
        <iocs>
          <urls>
            <value>
              <url>http://ns.adobe.com/pdf/1.3</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://ns.adobe.com/xap/1.0</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://purl.org/dc/elements/1.1</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.aiim.org/pdfa/ns/id</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>http://www.color.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>aiim.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>color.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>ns.adobe.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>purl.org</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>172.67.70.181</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>207.241.225.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>199.60.103.115</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>2766e30e325e3ac3aff58dafb34a07cc07c4f8bf1e0575fc4324b141375f00c7</SHA-256>
              <SHA-1>f10f25705246812dd949a4b72b033b6b909679c0</SHA-1>
              <MD5>af29362f575540ea401a18287643973f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
            <value>
              <SHA-256>49a60be4b95b6d30da355a0c124af82b35000bce8f24f957d1c09ead47544a1e</SHA-256>
              <SHA-1>bac45b86a9c48fc3756a46809c101570d349737d</SHA-1>
              <MD5>24d3b502e1846356b0263f945ddd5529</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>text/xml</file_type>
            </value>
            <value>
              <SHA-256>54e85677082d3e84184c002fc123b8131d77a975425c377476389c096412d741</SHA-256>
              <SHA-1>fd8f706bf5b835737595cb6cdb66cb1e1e916753</SHA-1>
              <MD5>51b237e4b78479696a2b520f03144fae</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>x646c14:$btc: 1QAbstractTextDocumentLayou</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x647c2f:$btc: 1QPaintDeviceWindowPrivat</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x648612:$btc: 1QRhiShaderResourceBinding</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x64866f:$btc: 1QRhiSwapChainRenderTarge</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x6488a1:$btc: 1QShaderDescriptionPrivat</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x64917d:$btc: 1QWindowsDirectWriteFontDatabas</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x649212:$btc: 1QWindowsFontEngineDirectWrit</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x64923c:$btc: 1QWindowsGuiEventDispatche</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <btc_wallet>x6c4020:$btc: 1UQPropertyBindingFunctio</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>Qt6Gui.dll</name>
        <report_id>1a892c97-90fd-4926-9c8c-29694d592cd2</report_id>
        <tags>
          <value>peexe</value>
          <value>html</value>
          <value>pedll</value>
          <value>explorer</value>
          <value>fingerprint</value>
          <value>lolbin</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>adaptive-context</value>
          <value>anti-debug</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d2bc0da070540c31227d934b75903005c96f30ac1d200cfe65e7d85783a0efce</id>
    <title>Analysis Report for d2bc0da070540c31227d934b75903005c96f30ac1d200cfe65e7d85783a0efce</title>
    <updated>2026-08-20T21:11:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876e7bf2677ae4d366d430</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a876d7cf72d6ce80a271f5c</flow_id>
        <hash>d2bc0da070540c31227d934b75903005c96f30ac1d200cfe65e7d85783a0efce</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>0da26594f64324655c801e9022d653bb63c8c35a6e9edd6ea4e3b9f7d9904a89</SHA-256>
              <SHA-1>90a6291908c26f651d45cf00c6a2c3cb6fbd80ca</SHA-1>
              <MD5>f12179c9ce9f72dac80d606529555ffc</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>0eeb8f220ad601be76418a59bcd56a437aa1c997276357e4442327707b034267</SHA-256>
              <SHA-1>7de25dd2b6211777214072ed4b326e801e83a9f3</SHA-1>
              <MD5>cd6cc4b4eb60195fced66524922ac8df</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>1bca3129613d3e5019ac4bde03e99fc598190d60cde05f61633c1eb18eb5884a</SHA-256>
              <SHA-1>fcf6033db30ee055693ece58ed9030ffd7a2df52</SHA-1>
              <MD5>b26a95161f6eeb733f09f4578b1f8d7a</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>232f3760901066825d2cfbbd602fe208d3bee743e0a35f82246d3b537c1d671b</SHA-256>
              <SHA-1>97de9962fbe5547c3ba78c7ca0571824692fc8a1</SHA-1>
              <MD5>fdae3c0724d75156f820ea1060378cf7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>3cd553f6ca40cadf88f7f71b88b8711cd71acf42e312f65ed7af1a4486f5a757</SHA-256>
              <SHA-1>c6fd63cb3003294a1e242ff1e14f2887241700d1</SHA-1>
              <MD5>7ee35d6b800063a6ba5246ff2e02d388</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>42d64194807b60647c37cf9eb38d9b29f47f89fe78d7ddbbd5bac5e68ce39551</SHA-256>
              <SHA-1>caf42627191feea43ab280e3b0216f8d4b73486b</SHA-1>
              <MD5>e8f6e6c1bd67a92ae78861e20cf992b8</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>431e844bde18f905f3b0922b381f2f68accd21c87a86409314f77fc74432a57a</SHA-256>
              <SHA-1>97ff0588193fbe2b509071cba0b7e7cefe2f2c6f</SHA-1>
              <MD5>f72a1569204e2b6a237e3b1137c9f2e5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>43bd77d9b303cd7d4a2cc5b77c6c777fa872b27927d484ae0f556f0b1967e541</SHA-256>
              <SHA-1>596de9a1951b47c540de76f7e96df11d238ea10a</SHA-1>
              <MD5>1f745f28fe7133fef6e9108e9bad2f7c</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>5250fc7bc0186211009e1862ba023e7deaa120f071780e0d9c6caab90bbc5052</SHA-256>
              <SHA-1>7ac2c0635f0cf6f554e4d5383d927d39581c2126</SHA-1>
              <MD5>fef12dd2aaccb496e91e3d632418daf5</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>6b4efc3dbd9e5520e3da09ddbd73f8456397571dd6156ee97d304494ff0f394d</SHA-256>
              <SHA-1>f070e28ae8c213329527d3ff8ca059cfdb7deeb4</SHA-1>
              <MD5>777b2adea77f85dca99839f4fa9679ad</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>8d0d2c0df3b55f7ca8d7b5024d781ff3bdc331f6c63e1dd0e63f012304995e7b</SHA-256>
              <SHA-1>48951f282edb9703477dab1dced0e029ba44a62b</SHA-1>
              <MD5>6466ea4de98c7533ab77a576924e3357</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>8fd4951a430aa99e8069a617464f00a9f26a08d570175075c8b30bc158696298</SHA-256>
              <SHA-1>5fd32bbcbd3155f611c22abc175423fd6a718215</SHA-1>
              <MD5>233caec2d6c9b0d94e086ee5962b408f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>b6db39c9cfc0d0f676f56fd7ad3d4d39c6704cce05d90da196b3a558d385253e</SHA-256>
              <SHA-1>2393c9047828e9a16dd8edb292baf53d44c71f7e</SHA-1>
              <MD5>ae12212b4fd28f6db39cb996ca7be9d2</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>c10d1bcd6f769ff29536eb460b1b3c7ca229d0680b6e2fc5693236b41c0734f9</SHA-256>
              <SHA-1>300f7e41f44c7071dc8591c9e9acecdf354159fb</SHA-1>
              <MD5>e73da5cbbebe989f309ed32630d96f77</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>cb69681d963ca18f827f18b280bef1fe581e9d804f08c68b51bef405bc8b4826</SHA-256>
              <SHA-1>0369fee86cdacfeeaec28c65441e61910225b487</SHA-1>
              <MD5>1d1970d585474185734f1f33d2434179</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>cc8efc9dfcf1988f9873f5eb05450a27408666ff4dce40cebbd58090c6e6c5ae</SHA-256>
              <SHA-1>fe6c88c86f92233aa54cf23951f08c433ee35d7b</SHA-1>
              <MD5>dc8a6ed72f8dfe87b610d86281951caf</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>cf104654e7ad4db43017b1d9614d22cb1f9826b61ef53780fa1a834369e7d754</SHA-256>
              <SHA-1>18dc31e09c8467e72edd2f436b1238cebf0a3f69</SHA-1>
              <MD5>a7ba31130c99060851dec3f67e0e5778</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>d2969bf4d89e9f1f7c5d4def92632d77a42db910a7185da9e4f91ddbb0776f47</SHA-256>
              <SHA-1>1d2502a3d43c9558565af1d7bc90c4f74d25c392</SHA-1>
              <MD5>2837e933f2b8b1f5f78fd8bce6d280f4</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>dbf6d5021777f4b7ac549c86e00522c84bf6687ef0333025f663333fa241c9e7</SHA-256>
              <SHA-1>7f4907256c6418a272b9b66bce1bb688481b0ff9</SHA-1>
              <MD5>e0cf33b40a275489b084fde75443841f</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>x478170:$btc: 3333333333333333333333333333</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>Dolphin.exe</name>
        <report_id>b857bc8f-fcba-4286-bc70-76fa3cd26579</report_id>
        <tags>
          <value>peexe</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>anti-vm</value>
          <value>anti-debug</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd</id>
    <title>Analysis Report for e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd</title>
    <updated>2026-08-20T21:10:25Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876d54f2677ae4d366d3d7</_id>
        <file_type>application/x-msdownload; format=pe64</file_type>
        <flow_id>6a876d400dfb99c1ceb076c6</flow_id>
        <hash>e7c5f34dbbae4d49edee90f7ad98c6e548f50b8c86a9f6ce0b15e49491cafabd</hash>
        <iocs>
          <btc_wallets>
            <value>
              <btc_wallet>x21e05d:$btc: 13CommonrdtscppopcntStringForma</btc_wallet>
              <origin>INPUT_FILE</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>file.exe</name>
        <report_id>3f8e9d47-4250-4d7c-a065-fd7d5c3709b4</report_id>
        <tags>
          <value>peexe</value>
          <value>golang</value>
          <value>invalid-signature</value>
          <value>self-signed-cert</value>
          <value>signed</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>dad7563802eabf803fe0c7830fefbec5e2f15d34109dbdd31721ca82b3e81772</id>
    <title>Analysis Report for dad7563802eabf803fe0c7830fefbec5e2f15d34109dbdd31721ca82b3e81772</title>
    <updated>2026-08-20T21:08:36Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876ce0f2677ae4d366d3b7</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a876cd3f72d6ce80a271d73</flow_id>
        <hash>dad7563802eabf803fe0c7830fefbec5e2f15d34109dbdd31721ca82b3e81772</hash>
        <iocs>
          <files>
            <value>
              <SHA-256>28f2e8e308a7fd8eaa69d49bc6a7f36dec590a3fc77a1ce17012402a85939c4f</SHA-256>
              <SHA-1>996b934ee28e55b962cecee7172190031e8e3253</SHA-1>
              <MD5>251a8dd656608eacbdacbd235f91b339</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>2a31a23f3e55b7b2e0ad777e6b92d6b3ec71ade3b101f239de711a17af6efef6</SHA-256>
              <SHA-1>04911d2aac6914892c8c921528de696ad86d88b9</SHA-1>
              <MD5>293d29f27ff987120f4648ebcbfbc784</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>3801536907d2cffe216dda35c7fab46e36f0802c9738d1d52f79a9d19ba9fc4a</SHA-256>
              <SHA-1>344bbc216eeb6eba8e5fc6ce9f6bf3ded62fa918</SHA-1>
              <MD5>bd322d31714690439d11eb16737f4821</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>8ac5e2c08e72998d06b9e79cc3522364730330763554bbebdfabc9a7bf0d1b46</SHA-256>
              <SHA-1>62ba9c1c73df21644c609d3b5fd2edc946eafadb</SHA-1>
              <MD5>534215cef211a152679a4cc7bd91b7e1</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>b3192a18fb10675280f881680135b4f37d7fdc5af7d201069c1b3f47aa54d7e3</SHA-256>
              <SHA-1>e29320ba2f2fddd739a8d2237c3117450ac2011c</SHA-1>
              <MD5>458152437bed22f7bd89dc69aaf15bd7</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/dib</file_type>
            </value>
            <value>
              <SHA-256>bb0f432405dd0146e10cad611fc2eacda864a4705a7cf27b7957c432ad437b7e</SHA-256>
              <SHA-1>3c83859ad32e00831d73c3e7e0ecf016ed70a8a2</SHA-1>
              <MD5>c9f2e144c594f125c93d67c8589f94cb</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>c52af911c0eed0a879758d4cd35324b99711beb31ec56d76a535e73c6a8a643e</SHA-256>
              <SHA-1>0e5c075a234db7965263af06115afd34bb4fc7a9</SHA-1>
              <MD5>60895d08152801be0c28d4c610a88fbf</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
            <value>
              <SHA-256>e5fadec1ca3f88b262845c6e300b837214a554eae5084921f3c5178b74c1796d</SHA-256>
              <SHA-1>66821612a3fff9cd372d29d23f1a1132a759895e</SHA-1>
              <MD5>84f9c249f731e2e8756bc805e0eb83f0</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/vnd.microsoft.icon</file_type>
            </value>
          </files>
          <btc_wallets>
            <value>
              <btc_wallet>384ebc177c2b7986bf5572663b3dedd5</btc_wallet>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </btc_wallets>
        </iocs>
        <name>FashionBusiness.exe</name>
        <report_id>09443027-2382-4120-bff5-423eabec49aa</report_id>
        <tags>
          <value>peexe</value>
          <value>mingw</value>
          <value>anti-debug</value>
          <value>packed</value>
          <value>installer-heuristic</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>9576dc1dca9960c73ac40afa4d64b62b56ad1c4519e1989ee6ca2166b8c4c860</id>
    <title>Analysis Report for 9576dc1dca9960c73ac40afa4d64b62b56ad1c4519e1989ee6ca2166b8c4c860</title>
    <updated>2026-08-20T21:07:33Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876cabf2677ae4d366d3a6</_id>
        <file_type>application/x-msdownload; format=pe64</file_type>
        <flow_id>6a876c920dfb99c1ceb073e2</flow_id>
        <hash>9576dc1dca9960c73ac40afa4d64b62b56ad1c4519e1989ee6ca2166b8c4c860</hash>
        <iocs>
          <urls>
            <value>
              <url>http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl3.digicert.com/sha2-assured-ts.crl02</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0J</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://crl4.digicert.com/sha2-assured-ts.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.digicert.com/CPS0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.digicert.com/ssl-cps-repository.htm0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/Docs/Repository.htm0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Third%20Party%20Component%20CA%202012.crt0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>http://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Third%20Party%20Component%20CA%202012.crl0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.digicert.com/CPS0</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.microsoft.com/en-us/windows</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cacerts.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl.microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl3.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>crl4.digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>digicert.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>microsoft.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>2.16.164.49</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>23.11.40.157</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>150.171.109.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>45.60.121.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>bc1b26703c4db380ed3b1408a9b56cbc7514b2cd244a640b4256637a13cdb116</SHA-256>
              <SHA-1>0daca05237025820cb2f558815ee04f3ac8eb815</SHA-1>
              <MD5>7e472df688d8e1dbd0cdd34377e2ee35</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
          <registry>
            <value>
              <registry>System\CurrentControlSet\Control\Class</registry>
              <origin>INPUT_FILE</origin>
            </value>
          </registry>
        </iocs>
        <name>libwasys.sys</name>
        <report_id>2719f486-e5ac-41a4-8f0a-d217a91bcddf</report_id>
        <tags>
          <value>peexe</value>
          <value>pesys</value>
          <value>expired-cert</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
          <value>signed</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>c8d4f45ca81979acda889aaa1b4334e010b70e4c3960b15d323d2829ab424257</id>
    <title>Analysis Report for c8d4f45ca81979acda889aaa1b4334e010b70e4c3960b15d323d2829ab424257</title>
    <updated>2026-08-20T21:06:52Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876ca7f2677ae4d366d3a4</_id>
        <file_type>application/x-dosexec</file_type>
        <flow_id>6a876c6a0dfb99c1ceb07336</flow_id>
        <hash>c8d4f45ca81979acda889aaa1b4334e010b70e4c3960b15d323d2829ab424257</hash>
        <iocs>
          <ips>
            <value>
              <ip>127.0.0.1</ip>
              <origin>INPUT_FILE</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>299e7fef24588f5951f1f28a15ab90c75514bedfd63d43574da006e9e2cac808</SHA-256>
              <SHA-1>1c77fb0072772b1fa833461f84e009b65799056e</SHA-1>
              <MD5>ed01113be6c948c65c1739ac549366c3</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>application/octet-stream</file_type>
            </value>
          </files>
        </iocs>
        <name>winhttp.exe</name>
        <report_id>1a50214b-9a64-4b1f-9fb7-307e53d37059</report_id>
        <tags>
          <value>peexe</value>
          <value>pedll</value>
          <value>reconnaissance</value>
          <value>microsoft_visual_cc</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>4f40d0286fc6e5aef6eada5cdc983ab101b8c95b7f0c75f6ebf5f4ac3c30176e</id>
    <title>Analysis Report for 4f40d0286fc6e5aef6eada5cdc983ab101b8c95b7f0c75f6ebf5f4ac3c30176e</title>
    <updated>2026-08-20T21:06:02Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876c70f2677ae4d366d391</_id>
        <file_type>application/pdf</file_type>
        <flow_id>6a876c3867502b6ca997ac0e</flow_id>
        <hash>4f40d0286fc6e5aef6eada5cdc983ab101b8c95b7f0c75f6ebf5f4ac3c30176e</hash>
        <iocs>
          <urls>
            <value>
              <url>https://brwarch-contoso-onedrive-access-ons3folder.s3.amazonaws.com/brwarch/1787152925908-index.html?AWSAccessKeyId=AKIAQH3SBYA3VKXZUSFO&amp;Signature=rPhP77ZA%2BvT7TNYqeD52mnAzAU0%3D&amp;Expires=1787757729</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://brwarch-contoso-onedrive-access-ons3folder.s3.amazonaws.com/brwarch/1787152925908-index.html?AWSAccessKeyId=AKIAQH3SBYA3VKXZUSFO&amp;Signature=rPhP77ZA%2BvT7TNYqeD52mnAzAU0%3D&amp;Expires=1787757729</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>brwarch-contoso-onedrive-access-ons3folder.s3.amazonaws.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>brwarch-contoso-onedrive-access-ons3folder.s3.amazonaws.com</url>
              <origin>CONTENT_PARSE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>16.15.0.107</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>5290cbd8827d984679d534386710738e3bd26c0ca91c040cedcd161464023d02</SHA-256>
              <SHA-1>6d4aeffc127eb5f80981c0daf0f1b2735ae22c26</SHA-1>
              <MD5>cc37c9ed7ee31aa50a4a7fcfa3cc4a2d</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
            <value>
              <SHA-256>afa4a6601393dff1d26748765db13ea736f6ce61956c09e2db8889d282168fb3</SHA-256>
              <SHA-1>bff4a69c8fb85e93868984e883149e934728989a</SHA-1>
              <MD5>0ddffdc88d8146dca819b6abace0f6af</MD5>
              <origin>INPUT_FILE</origin>
              <file_type>image/png</file_type>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>505643af-0738-425d-9c09-2885ebb68789</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>bfbe7667-6721-458a-80b3-b579673fbf24</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>ScopeofProject_locked_06X960LWPDV-2.pdf</name>
        <report_id>7a75af2e-c9b6-4439-bbfe-5129b97a49b2</report_id>
        <tags>
          <value>pdf</value>
          <value>phishing</value>
          <value>form</value>
          <value>macros</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>64daa9889c22bf3225dfbb6c4781a2cdfcec5d7a892fa1d517fcfdfd9b2f7582</id>
    <title>Analysis Report for 64daa9889c22bf3225dfbb6c4781a2cdfcec5d7a892fa1d517fcfdfd9b2f7582</title>
    <updated>2026-08-20T21:05:20Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876c94f2677ae4d366d39d</_id>
        <file_type>text/x-shellscript</file_type>
        <flow_id>6a876c0d5a70bef4cd150c4f</flow_id>
        <hash>64daa9889c22bf3225dfbb6c4781a2cdfcec5d7a892fa1d517fcfdfd9b2f7582</hash>
        <iocs>
          <urls>
            <value>
              <url>http://160.119.69.4/x</url>
              <origin>INPUT_FILE</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>http://160.119.69.4/hima_data/index.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>http://45.95.147.178/hima_data/index.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
            <value>
              <url>http://45.95.147.178/k.php</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>MALICIOUS</verdict>
            </value>
          </urls>
          <ips>
            <value>
              <ip>160.119.69.4</ip>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>160.119.69.4</ip>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>45.95.147.178</ip>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>51443c11b8823d97205f7772280643f9defe6c67387a39c8480c2a82876aed41</SHA-256>
              <SHA-1>db6ab96a7dbd90a929085c88ce77c0a6a434c663</SHA-1>
              <MD5>9a39b1401afb08494998100ce2fc1755</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/x-shellscript</file_type>
              <verdict>LIKELY_MALICIOUS</verdict>
            </value>
          </files>
        </iocs>
        <name>k.php.sh</name>
        <report_id>d9bf37a3-7b2a-4263-bbe1-f25cea65221d</report_id>
        <tags>
          <value>shell</value>
          <value>base64</value>
          <value>obfuscated</value>
          <value>evasive</value>
          <value>bash</value>
          <value>lolbin</value>
          <value>masquerade</value>
        </tags>
        <verdict>MALICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>7683db016dd4e24e2cdbfdfebb03dd22cc40f638847f2a8ef5d42027b42dea5f</id>
    <title>Analysis Report for 7683db016dd4e24e2cdbfdfebb03dd22cc40f638847f2a8ef5d42027b42dea5f</title>
    <updated>2026-08-20T21:04:31Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876c6bf2677ae4d366d38d</_id>
        <file_type>text/html</file_type>
        <flow_id>6a876bdcf72d6ce80a271ad2</flow_id>
        <hash>7683db016dd4e24e2cdbfdfebb03dd22cc40f638847f2a8ef5d42027b42dea5f</hash>
        <iocs>
          <urls>
            <value>
              <url>http://www.economist.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://uk.linkedin.com/company/the-economist</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.economist.com/by-invitation/2026/08/17/donald-trumps-deregulatory-drive-will-cause-another-financial-crisis&amp;urlhash=23yo&amp;trk=organization_guest_main-feed-card_feed-article-content</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.economist.com/middle-east-and-africa/2026/08/20/zambias-tainted-election-threatens-its-reputation&amp;urlhash=6JBY&amp;trk=organization_guest_main-feed-card_feed-article-content</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/the-economist&amp;fromSignIn=true&amp;trk=organization_guest_nav-header-signin</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/the-economist&amp;fromSignIn=true&amp;trk=top-card_top-card-secondary-button-top-card-secondary-cta</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/the-economist&amp;trk=organization_guest_main-feed-card_comment-cta</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/the-economist&amp;trk=organization_guest_main-feed-card_like-cta</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/the-economist&amp;trk=organization_guest_main-feed-card_share-cta</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/the-economist&amp;trk=organization_guest_main-feed-card_social-actions-comments</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/the-economist&amp;trk=organization_guest_main-feed-card_social-actions-reactions</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/company/the-economist&amp;trk=organization_guest_nav-header-join</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/search/results/people/?facetCurrentCompany=%5B166368%5D&amp;trk=org-employees_cta_face-pile-cta</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/search/results/people/?facetCurrentCompany=%5B166368%5D&amp;trk=public_biz_employees-join</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://bit.ly/3UJPHoF?trk=organization_guest_main-feed-card-text</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://bit.ly/45z7Yrc?trk=organization_guest_main-feed-card-text</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://bit.ly/4fWBvkE?trk=organization_guest_main-feed-card-text</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://bit.ly/4g9BA4t?trk=organization_guest_main-feed-card-text</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://bit.ly/4zrSYcl?trk=organization_guest_main-feed-card-text</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>http://schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://about.linkedin.com?trk=d_org_guest_company_overview_footer-about</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://bg.linkedin.com/in/irenakomitova?trk=org-employees</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://brand.linkedin.com/policies?trk=d_org_guest_company_overview_footer-brand-policy</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://ch.linkedin.com/company/world-economic-forum?trk=similar-pages</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://econ.st/2OZnq92</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://media.licdn.com/dms/image/v2/D560BAQFZUavdWG_s-g/company-logo_200_200/company-logo_200_200/0/1729261218803/the_economist_logo?e=2147483647&amp;v=beta&amp;t=3qZs1I7gF0BWOIGKjPP_AOzk8gqx2fOzwB-YvSEmMOI</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/26g24klhu4k9p8zgtz6fs4k01</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/94r1rf57co3zoo13wr8n540ve</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/al2o9zrvru7aqj8e1x2rzsrca</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://static.licdn.com/aero-v1/sc/h/axo5zvk1a9cvtefjtcfh438kr</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://uk.linkedin.com/company/bbc-news?trk=similar-pages</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://uk.linkedin.com/company/financial-times?trk=similar-pages</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://uk.linkedin.com/company/the-economist/jobs?trk=nav_type_jobs</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://uk.linkedin.com/company/the-economist/life?trk=nav_type_life</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://uk.linkedin.com/company/the-economist?trk=nav_type_overview</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://uk.linkedin.com/company/the-economist?trk=organization_guest_main-feed-card_feed-actor-image</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://uk.linkedin.com/company/the-economist?trk=organization_guest_main-feed-card_feed-actor-name</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://uk.linkedin.com/in/rosenthaljonathan?trk=org-employees</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://uk.linkedin.com/in/zanny-minton-beddoes?trk=organization_guest_main-feed-card-text</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://uk.linkedin.com/showcase/%E3%80%8A%E7%BB%8F%E6%B5%8E%E5%AD%A6%E4%BA%BA%C2%B7%E5%85%A8%E7%90%83%E5%95%86%E4%B8%9A%E8%AF%84%E8%AE%BA%E3%80%8B/?trk=affiliated-pages</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://uk.linkedin.com/showcase/the-economist-careers-network/?trk=affiliated-pages</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.bing.com/maps?where=1-11+John+Adam+Street+London+WC2N+6HT+London+GB&amp;trk=org-locations_url</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.linkedin.com/games?trk=organization_guest_guest_nav_menu_games</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/help/linkedin/ask/TS-RIC-LO</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/help/linkedin/ask/TS-RIC-LO?entityUrn=https%3A%2F%2Fuk.linkedin.com%2Fcompany%2Fthe-economist</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/in/sarahoconnor?trk=org-employees</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/search?trk=organization_guest_guest_nav_menu_jobs</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/jobs/the-economist-jobs-worldwide?f_C=166368&amp;trk=top-card_top-card-primary-button-top-card-primary-cta</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/learning/search?trk=organization_guest_guest_nav_menu_learning</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/legal/cookie-policy</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/login</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/login?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Fthe-economist&amp;fromSignIn=true&amp;trk=organization_guest_nav-header-signin</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/login?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Fthe-economist&amp;fromSignIn=true&amp;trk=top-card_top-card-secondary-button-top-card-secondary-cta</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/mypreferences/g/guest-cookies</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/the-economist_a-messy-ballot-is-another-sign-that-democratic-activity-7496295065401597952-oxAB</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/the-economist_an-interview-with-yuval-noah-harari-the-activity-7496276134880342016-6l_S</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/the-economist_an-interview-with-yuval-noah-harari-the-activity-7496306336188628993-EaDe</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/the-economist_contrails-may-do-more-to-raise-the-planet-activity-7496279943849463809-s42m</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/the-economist_donald-trumps-deregulatory-drive-will-cause-activity-7496302578574540802-EW--</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/the-economist_the-dreams-of-an-open-world-that-followed-activity-7496310149490499584-pvqu</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/posts/the-economist_zambias-tainted-election-threatens-its-reputation-activity-7496272378654580737-KtIL</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/pub/dir/+/+?trk=organization_guest_guest_nav_menu_people</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/redir/redirect</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/redir/redirect?url=http%3A%2F%2Fwww%2Eeconomist%2Ecom&amp;urlhash=pwHD&amp;trk=about_website</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/redir/redirect?url=https%3A%2F%2Fwww%2Eeconomist%2Ecom%2Fby-invitation%2F2026%2F08%2F17%2Fdonald-trumps-deregulatory-drive-will-cause-another-financial-crisis&amp;urlhash=23yo&amp;trk=organization_guest_main-feed-card_feed-article-content</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/redir/redirect?url=https%3A%2F%2Fwww%2Eeconomist%2Ecom%2Fmiddle-east-and-africa%2F2026%2F08%2F20%2Fzambias-tainted-election-threatens-its-reputation&amp;urlhash=6JBY&amp;trk=organization_guest_main-feed-card_feed-article-content</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Fthe-economist&amp;trk=organization_guest_main-feed-card_comment-cta</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Fthe-economist&amp;trk=organization_guest_main-feed-card_like-cta</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Fthe-economist&amp;trk=organization_guest_main-feed-card_share-cta</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Fthe-economist&amp;trk=organization_guest_main-feed-card_social-actions-comments</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Fthe-economist&amp;trk=organization_guest_main-feed-card_social-actions-reactions</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fcompany%2Fthe-economist&amp;trk=organization_guest_nav-header-join</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fsearch%2Fresults%2Fpeople%2F%3FfacetCurrentCompany%3D%255B166368%255D&amp;trk=org-employees_cta_face-pile-cta</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/signup/cold-join?session_redirect=https%3A%2F%2Fwww%2Elinkedin%2Ecom%2Fsearch%2Fresults%2Fpeople%2F%3FfacetCurrentCompany%3D%255B166368%255D&amp;trk=public_biz_employees-join</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/top-content?trk=organization_guest_guest_nav_menu_topContent</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/uas/login-submit</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/the-economist/?utm_source=sfmc&amp;utm_term=linkedin&amp;utm_content=356746&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=linkedin&amp;id_mc=293523163</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>about.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>bg.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>bit.ly</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>brand.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ch.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>econ.st</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>media.licdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>schema.org</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>static.licdn.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>uk.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.bing.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.economist.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>172.64.146.215</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>67.199.248.13</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>67.199.248.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.64.145.237</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.41.41</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>2.16.241.205</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.100</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>130.211.32.14</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>146.75.123.42</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>bdd75293c78cae94b7d822b483af2fd424c167abaf677eaac221b433eba93042</SHA-256>
              <SHA-1>f53024e2a75eb0b1a463435c10677b65ad57366a</SHA-1>
              <MD5>52080a0a33394e31cf2438ee4df75e99</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/jpeg</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>39f076abc31144853592ee5b1a1588c5aee8642b4223626ea0327934b056d11b</SHA-256>
              <SHA-1>01b179bfbb8ae1fa1ae8f4e877919e44933f9346</SHA-1>
              <MD5>fcf1f8eb2b099730bee25ef7dc2d4562</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>220bcb1ca2a00dad8195df3f900f82cab60fa423364e9d9aff31559947bf15ce</SHA-256>
              <SHA-1>8d52cf5d7815d3679d1cd8f326471edfe9fd9f34</SHA-1>
              <MD5>4ddcdb6a2d207dd0277856f0549bcf60</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>bc4cef59a1590a1910aaca47cd26edef879a93d37d91ce4ba86a3d4d038b47f5</SHA-256>
              <SHA-1>f195cada4b8cf05f6b1b4896577515f05c5e35b4</SHA-1>
              <MD5>b9ecbf5acdfe5d6b94d4b9390991d1d7</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>b73daf969355ae4e6aa37d96f085ce902a2726e2245f5ffb36ca74badb19675a</SHA-256>
              <SHA-1>34ad3094a1fc21522d736d4057399e1313cfa715</SHA-1>
              <MD5>f830eb3f0c64c57af8eb6dc5d7122305</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>fb5cf546cdb6bf63f348dc8e2ae61446c49e8e7072b77ea3d9877998777f9bff</SHA-256>
              <SHA-1>e133e7759aa93ec13b78a28f7f9c68712fb6226b</SHA-1>
              <MD5>771da7ffdab1bcc27d686271c39800fc</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>a182d593207ac6d96b8518165562346b7b819e6c1de9a655eb0d83f3bea84458</SHA-256>
              <SHA-1>0c99a5b950506e3d821d7a75a1517fae60531d1d</SHA-1>
              <MD5>b99ad35a7e9c08eea605da36acb6d106</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>43fb3601-f655-4432-8168-11c43666e521</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://www.linkedin.com/company/the-economist/?utm_source=sfmc&amp;utm_term=linkedin&amp;utm_content=356746&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=linkedin&amp;id_mc=293523163</name>
        <report_id>b49af78c-9c97-458b-8f05-715465b31856</report_id>
        <tags>
          <value>html</value>
          <value>jpg</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>1ef21aae9d05cc8c1e0f1e938273572d06b7978f24df35f70673ca3178271c5c</id>
    <title>Analysis Report for 1ef21aae9d05cc8c1e0f1e938273572d06b7978f24df35f70673ca3178271c5c</title>
    <updated>2026-08-20T21:04:31Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876c1cf2677ae4d366d371</_id>
        <file_type>text/html</file_type>
        <flow_id>6a876bdcf72d6ce80a271ad3</flow_id>
        <hash>1ef21aae9d05cc8c1e0f1e938273572d06b7978f24df35f70673ca3178271c5c</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.youtube.com/user/economistmagazine?utm_source=sfmc&amp;utm_term=youtube&amp;utm_content=356746&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=youtube&amp;id_mc=293523163</url>
              <origin>INPUT_FILE</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://consent.youtube.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://consent.youtube.com/m</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://consent.youtube.com/save</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://csp.withgoogle.com/csp/proto/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=YouTube+Sans:700&amp;display=swap</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://kidsmanagement-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://kidsmanagement-pa.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://policies.google.com/privacy?hl=en&amp;utm_source=ucb</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/technologies/cookies?hl=en&amp;utm_source=ucb</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://policies.google.com/terms?hl=en&amp;utm_source=ucb</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.googleapis.com/reauth</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/_/boq-identity/_/r/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.ConsentUi.en.bqbiIlmPpyE.2018.O/am=AQAAAACZ/d=1/excm=_b</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.youtube.com/user/economistmagazine?utm_source%5Cu003dsfmc%5Cu0026utm_source%5Cu003denterprise-marketing-cloud%5Cu0026utm_term%5Cu003dyoutube%5Cu0026utm_term%5Cu003d20260820%5Cu0026utm_content%5Cu003d356746%5Cu0026utm_content%5Cu003dyoutube%5Cu0026utm_id%5Cu003d0dec9837-0599-4d3c-9b70-f049a253db59%5Cu0026utm_id%5Cu003d2225023%5Cu0026sfmc_activityid%5Cu003d2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%5Cu0026utm_medium%5Cu003demail%5Cu0026utm_medium%5Cu003demail-owned%5Cu0026utm_campaign%5Cu003dMA00021495%5Cu0026RefID%5Cu0026sfmc_id%5Cu003d00QWT00001258dX2AQ%5Cu0026id_mc%5Cu003d293523163%5Cu0026cbrd%5Cu003d1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.youtube.com/user/economistmagazine?utm_source=sfmc&amp;utm_source=enterprise-marketing-cloud&amp;utm_term=youtube&amp;utm_term=20260820&amp;utm_content=356746&amp;utm_content=youtube&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;cbrd=1</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://consent.youtube.com/m</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.youtube.com/m?continue=https%3A%2F%2Fwww.youtube.com%2Fuser%2Feconomistmagazine%3Futm_source%3Dsfmc%26utm_term%3Dyoutube%26utm_content%3D356746%26utm_id%3D0dec9837-0599-4d3c-9b70-f049a253db59%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail%26utm_campaign%3DMA00021495%26utm_medium%3Demail-owned%26utm_source%3Denterprise-marketing-cloud%26RefID%26utm_term%3D20260820%26utm_id%3D2225023%26sfmc_id%3D00QWT00001258dX2AQ%26utm_content%3Dyoutube%26id_mc%3D293523163%26cbrd%3D1&amp;gl=DE&amp;m=0&amp;pc=yt&amp;cm=2&amp;hl=en&amp;src=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=YouTube+Sans:700&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/googlesans/v62/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/i/short-term/release/youtube_outline/svg/alert_triangle_24px.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/i/short-term/release/youtube_outline/svg/bar_graph_24px.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/i/short-term/release/youtube_outline/svg/price_tag_24px.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/i/short-term/release/youtube_outline/svg/rating_up_24px.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/i/short-term/release/youtube_outline/svg/shield_24px.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/i/short-term/release/youtube_outline/svg/sparkle_24px.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/roboto/v48/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://policies.google.com/technologies/cookies?hl=en&amp;utm_source=ucb</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google.com/favicon.ico</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.ConsentUi.en.bqbiIlmPpyE.2018.O/am=AQAAAACZ/d=1/excm=_b,_tp,mainview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGADLM70yB4JIV1KeXLYNJ5K0zgNw/dti=1/m=_b,_tp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.ConsentUi.en.bqbiIlmPpyE.2018.O/ck=boq-identity.ConsentUi.aRCPG2ofh2k.L.B1.O/am=AQAAAACZ/d=1/exm=A7fCU,BBI74,BVgquf,EFQ78c,GkRiKb,IZT63,JNoxi,KUM7Z,LEikZe,LvGhrf,MdUzUe,MpJwZc,Ndreoc,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OgOVNe,P6sQOc,PHUIyb,PrPYRd,QIhFr,RMhBfe,RqjULd,RyvaUb,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ulmmrd,V3dDOb,WpP9Yc,XVMNvd,YTxL4,YYmHzb,Z5uLle,ZDZcre,ZwDk9d,_b,_tp,aW3pY,byfTOb,cYShmd,e5qFLc,fTfGO,fkuQ3,gychg,hc6Ubd,lsjVmc,lwddkf,m9oV,n73qwf,oJz28e,p3hmRc,pjICDe,pw70Gc,qmdT9,soHxf,vjKJJ,w9hDv,wg1P6b,ws9Tlc,xQtZb,xUdipf,y5vRwf,ywOR5c,zbML3c,zr1jrb/excm=_b,_tp,mainview/ed=1/wt=2/ujg=1/rs=AOaEmlFag0UUc11iDJK7GllAzvcMWAyV0g/ee=BcQPH:lOY4De;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NJ1rfe:qTnoBf;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:fTfGO;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;VlRiDf:j7ZRif;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;j9c1Cc:xywqXb;lOO0Vd:OTA3Ae;oGtAuc:sOXFj;oSUNyd:fTfGO;pXdRYb:MdUzUe;qQEoOc:KUM7Z;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:O1Gjze;xqZiqf:BBI74;yxTchf:KUM7Z;zxnPse:GkRiKb/dti=1/m=Wt6vjf,hhhU8,FCpbqb,WhJNk</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.ConsentUi.en.bqbiIlmPpyE.2018.O/ck=boq-identity.ConsentUi.aRCPG2ofh2k.L.B1.O/am=AQAAAACZ/d=1/exm=A7fCU,BBI74,BVgquf,EFQ78c,GkRiKb,IZT63,JNoxi,KUM7Z,LEikZe,LvGhrf,MdUzUe,MpJwZc,Ndreoc,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OgOVNe,PHUIyb,PrPYRd,QIhFr,RMhBfe,RqjULd,RyvaUb,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ulmmrd,V3dDOb,WpP9Yc,XVMNvd,YTxL4,YYmHzb,Z5uLle,ZDZcre,ZwDk9d,_b,_tp,aW3pY,byfTOb,cYShmd,e5qFLc,fTfGO,fkuQ3,gychg,hc6Ubd,lsjVmc,lwddkf,m9oV,n73qwf,oJz28e,p3hmRc,pjICDe,pw70Gc,qmdT9,soHxf,vjKJJ,w9hDv,wg1P6b,ws9Tlc,xQtZb,xUdipf,y5vRwf,ywOR5c,zbML3c,zr1jrb/excm=_b,_tp,mainview/ed=1/wt=2/ujg=1/rs=AOaEmlFag0UUc11iDJK7GllAzvcMWAyV0g/ee=BcQPH:lOY4De;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NJ1rfe:qTnoBf;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:fTfGO;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;VlRiDf:j7ZRif;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;j9c1Cc:xywqXb;lOO0Vd:OTA3Ae;oGtAuc:sOXFj;oSUNyd:fTfGO;pXdRYb:MdUzUe;qQEoOc:KUM7Z;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:O1Gjze;xqZiqf:BBI74;yxTchf:KUM7Z;zxnPse:GkRiKb/dti=1/m=P6sQOc</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.ConsentUi.en.bqbiIlmPpyE.2018.O/ck=boq-identity.ConsentUi.aRCPG2ofh2k.L.B1.O/am=AQAAAACZ/d=1/exm=A7fCU,BBI74,BVgquf,EFQ78c,GkRiKb,IZT63,JNoxi,KUM7Z,LEikZe,MdUzUe,MpJwZc,Ndreoc,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OgOVNe,PHUIyb,PrPYRd,QIhFr,RMhBfe,RyvaUb,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ulmmrd,V3dDOb,WpP9Yc,XVMNvd,YTxL4,YYmHzb,Z5uLle,ZDZcre,ZwDk9d,_b,_tp,aW3pY,byfTOb,cYShmd,e5qFLc,fTfGO,fkuQ3,gychg,hc6Ubd,lsjVmc,lwddkf,m9oV,n73qwf,oJz28e,pjICDe,pw70Gc,qmdT9,soHxf,vjKJJ,w9hDv,wg1P6b,ws9Tlc,xQtZb,xUdipf,y5vRwf,ywOR5c,zbML3c,zr1jrb/excm=_b,_tp,mainview/ed=1/wt=2/ujg=1/rs=AOaEmlFag0UUc11iDJK7GllAzvcMWAyV0g/ee=BcQPH:lOY4De;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NJ1rfe:qTnoBf;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:fTfGO;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;VlRiDf:j7ZRif;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;j9c1Cc:xywqXb;lOO0Vd:OTA3Ae;oGtAuc:sOXFj;oSUNyd:fTfGO;pXdRYb:MdUzUe;qQEoOc:KUM7Z;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:O1Gjze;xqZiqf:BBI74;yxTchf:KUM7Z;zxnPse:GkRiKb/dti=1/m=p3hmRc,LvGhrf,RqjULd</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.ConsentUi.en.bqbiIlmPpyE.2018.O/ck=boq-identity.ConsentUi.aRCPG2ofh2k.L.B1.O/am=AQAAAACZ/d=1/exm=A7fCU,BBI74,BVgquf,EFQ78c,GkRiKb,IZT63,JNoxi,KUM7Z,LEikZe,MdUzUe,MpJwZc,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OgOVNe,PrPYRd,QIhFr,RMhBfe,RyvaUb,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ulmmrd,V3dDOb,WpP9Yc,XVMNvd,YTxL4,YYmHzb,Z5uLle,ZDZcre,ZwDk9d,_b,_tp,aW3pY,byfTOb,cYShmd,e5qFLc,fTfGO,fkuQ3,gychg,hc6Ubd,lsjVmc,lwddkf,m9oV,n73qwf,pjICDe,pw70Gc,qmdT9,vjKJJ,w9hDv,ws9Tlc,xQtZb,xUdipf,y5vRwf,zbML3c,zr1jrb/excm=_b,_tp,mainview/ed=1/wt=2/ujg=1/rs=AOaEmlFag0UUc11iDJK7GllAzvcMWAyV0g/ee=BcQPH:lOY4De;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NJ1rfe:qTnoBf;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:fTfGO;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;VlRiDf:j7ZRif;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;j9c1Cc:xywqXb;lOO0Vd:OTA3Ae;oGtAuc:sOXFj;oSUNyd:fTfGO;pXdRYb:MdUzUe;qQEoOc:KUM7Z;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:O1Gjze;xqZiqf:BBI74;yxTchf:KUM7Z;zxnPse:GkRiKb/dti=1/m=Ndreoc,wg1P6b,soHxf,ywOR5c,PHUIyb,oJz28e</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.ConsentUi.en.bqbiIlmPpyE.2018.O/ck=boq-identity.ConsentUi.aRCPG2ofh2k.L.B1.O/am=AQAAAACZ/d=1/exm=A7fCU,BBI74,BVgquf,EFQ78c,GkRiKb,IZT63,JNoxi,KUM7Z,LEikZe,MdUzUe,MpJwZc,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OgOVNe,PrPYRd,QIhFr,RMhBfe,RyvaUb,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ulmmrd,V3dDOb,WpP9Yc,XVMNvd,YTxL4,YYmHzb,Z5uLle,ZDZcre,ZwDk9d,_b,_tp,aW3pY,byfTOb,cYShmd,e5qFLc,fTfGO,gychg,hc6Ubd,lsjVmc,lwddkf,m9oV,n73qwf,pjICDe,pw70Gc,qmdT9,vjKJJ,w9hDv,ws9Tlc,xQtZb,xUdipf,y5vRwf,zbML3c,zr1jrb/excm=_b,_tp,mainview/ed=1/wt=2/ujg=1/rs=AOaEmlFag0UUc11iDJK7GllAzvcMWAyV0g/ee=BcQPH:lOY4De;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NJ1rfe:qTnoBf;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:fTfGO;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;VlRiDf:j7ZRif;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;j9c1Cc:xywqXb;lOO0Vd:OTA3Ae;oGtAuc:sOXFj;oSUNyd:fTfGO;pXdRYb:MdUzUe;qQEoOc:KUM7Z;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:O1Gjze;xqZiqf:BBI74;yxTchf:KUM7Z;zxnPse:GkRiKb/dti=1/m=fkuQ3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.ConsentUi.en.bqbiIlmPpyE.2018.O/ck=boq-identity.ConsentUi.aRCPG2ofh2k.L.B1.O/am=AQAAAACZ/d=1/exm=_b,_tp/excm=_b,_tp,mainview/ed=1/wt=2/ujg=1/rs=AOaEmlFag0UUc11iDJK7GllAzvcMWAyV0g/ee=BcQPH:lOY4De;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NJ1rfe:qTnoBf;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:fTfGO;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;VlRiDf:j7ZRif;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;j9c1Cc:xywqXb;lOO0Vd:OTA3Ae;oGtAuc:sOXFj;oSUNyd:fTfGO;pXdRYb:MdUzUe;qQEoOc:KUM7Z;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:O1Gjze;xqZiqf:BBI74;yxTchf:KUM7Z;zxnPse:GkRiKb/dti=1/m=ws9Tlc,O6y8ed,aW3pY,GkRiKb,e5qFLc,IZT63,YYmHzb,pw70Gc,n73qwf,UUJqVe,KUM7Z,O1Gjze,byfTOb,lsjVmc,xUdipf,ZDZcre,OTA3Ae,ZwDk9d,RyvaUb,fTfGO,m9oV,vjKJJ,y5vRwf,PrPYRd,MpJwZc,LEikZe,NwH0H,V3dDOb,cYShmd,XVMNvd,WpP9Yc,QIhFr,xQtZb,lwddkf,gychg,w9hDv,RMhBfe,qmdT9,SdcwHb,EFQ78c,Ulmmrd,A7fCU,hc6Ubd,JNoxi,BVgquf,SpsfSb,Z5uLle,BBI74,MdUzUe,zbML3c,zr1jrb,YTxL4,Uas9Hd,OgOVNe,pjICDe</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/ac/cb/youtube_logo_v2.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.youtube.com/user/economistmagazine?utm_source=sfmc&amp;utm_term=youtube&amp;utm_content=356746&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=youtube&amp;id_mc=293523163&amp;cbrd=1&amp;gl=DE&amp;m=0&amp;pc=yt&amp;cm=2&amp;hl=en&amp;src=1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>consent.youtube.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>policies.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>consent.youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>csp.withgoogle.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>gstatic.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>kidsmanagement-pa.clients6.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>kidsmanagement-pa.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>policies.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.gstatic.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>youtube.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.14.138</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.250.154.136</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.94</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.217.118.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.217.115.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.120</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.141</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.110.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.113</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.14.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.156.119</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.150.4</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>333db0900450107294324d3c9cf94446cdfc6417c1afff82b5a862b5d5422181</SHA-256>
              <SHA-1>070215a3280c967f3d3519141cefe7a9d0b60b3c</SHA-1>
              <MD5>c71e58b70e722cc3691b3800e383f28e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>5c35a1a4040bfd49599e6df340a30164b50d4a2f61849100ce4bbe43a647b567</SHA-256>
              <SHA-1>9719b6458c938ab8b3bf4c40ebad30d06810590d</SHA-1>
              <MD5>329a0aab62fed93a509c6cf1549534cd</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>9d12e62ca0bd3b01d40617b886092b3ccb43a45dd98a79e231abd0bb51e0a907</SHA-256>
              <SHA-1>b4b1046fd35964bd61ef933bbd0c36cce6f8fe50</SHA-1>
              <MD5>efd1bea7d849f3b2d89ea0d0f1595504</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>86612202126cd6f0766446dacd905b7dcf83d66216f6fe16ab5c4c6a06dded43</SHA-256>
              <SHA-1>10e219e2cd023657ae2657e5804210f1785630db</SHA-1>
              <MD5>f5ab53e325131fa44d482d9753397295</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>64fa8d431309f2620eb8a1d2f31ae51f8a2065d0f1410e4a023dcd371c8d09b9</SHA-256>
              <SHA-1>78b8d0747fb96e2fb79dca2c552d395662068274</SHA-1>
              <MD5>9b2bd850b5bce114b6ca78fc0f9b80f3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>4ddd51303860cfbd6a7a57d59c8a6491234f430bc8fd4044a758415ed15a0443</SHA-256>
              <SHA-1>d81b6dd9190d5fec0da153c21c7269e4e6679fa2</SHA-1>
              <MD5>b6ba684f4cf7e11c1d799c8e11990010</MD5>
              <origin>CONTENT_PARSE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>b9d186417b30a687345e3db8cbc562ffcc4f625e7d4c3eda6349e321e45682f1</SHA-256>
              <SHA-1>1b1fd214e232fcfc44dc53aebb9ae59eaa7f6d68</SHA-1>
              <MD5>0ab138aad5090ae550f0130586608f78</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>f313e46b7a42ebb2857a709d396e679d9d8ffe66fc383adcce7e0f467cc86d54</SHA-256>
              <SHA-1>640fbcdc6145b668c04bc8840e3bed913fb7bb06</SHA-1>
              <MD5>d25b167c68c853f43e68632734a6821e</MD5>
              <origin>EXTERNAL_PARSER</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>0dec9837-0599-4d3c-9b70-f049a253db59</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>2f6ba746-8c19-4be5-be5b-2bf24aca6a6f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://www.youtube.com/user/economistmagazine?utm_source=sfmc&amp;utm_term=youtube&amp;utm_content=356746&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=youtube&amp;id_mc=293523163</name>
        <report_id>05c0441a-a30c-4649-95d5-cddabcabdc9d</report_id>
        <tags>
          <value>html</value>
          <value>txt</value>
          <value>aidetect</value>
          <value>phishing</value>
          <value>base64</value>
          <value>obfuscated</value>
        </tags>
        <verdict>BENIGN</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e889f10c93135ba729f8f67225529531b82b41e4bd407fe17d70b0633f0dc8ca</id>
    <title>Analysis Report for e889f10c93135ba729f8f67225529531b82b41e4bd407fe17d70b0633f0dc8ca</title>
    <updated>2026-08-20T21:04:31Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876c63f2677ae4d366d389</_id>
        <file_type>application/xhtml+xml</file_type>
        <flow_id>6a876bdc099a97c449ef4251</flow_id>
        <hash>e889f10c93135ba729f8f67225529531b82b41e4bd407fe17d70b0633f0dc8ca</hash>
        <iocs>
          <urls>
            <value>
              <url>https://click.b.economist.com/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTREv1wtqI6iuqioG_CSxyW41QLHOSBi9SCUy84agj7lLrfDxINK3sHkrNvwa4xs79qXIfHhH24A01XZhZj5n8k-rsiPBp8HujZo4qeXgg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://click.b.economist.com/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTREv1wuryPuOsiKbTAYLgzQQQG8kYM3M42p-8V8hg3R5f-A-1WscNPndILnQhAIkR7hhlq0Oazd9pB0yzRGWsdR5w7Tk6NXTqEcRO5rwA</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://click.b.economist.com/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTREv1wvFIHbaOh-ie1YWKlLCk5Vcuw64WLUpDxF2ts47rNdjAT0_Qt8F8VzumrsMufg1qQTDYFq8TduK4IolwquyM_7Yi0VjACYqPQqQA</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://click.b.economist.com/open.aspx?4-2225023-287090182-7295029-119-293523163-33&amp;d=70252&amp;bmt=0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTREv1w0ipZ_SAkUz2I6vhMl2Yu5_aq5k2uABQ2weenfGKC_2QucFRaZuxC3T91EXoY7ajCZyznbhAQcn4pDUWILRPwyHrNg9a8Qymz3Kg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTREv1w1vHo0ABAGvVngFwsB_bJEBo7NNBw4uQ5Dvr5fK9rHtNWNAxRyx7V5JYCdFAZi-c85AIDyqF5oPwm6xLXRwrC71Ra81Sw05rg__w</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTREv1w2mWwPFKSXtf7FxP35iaSX70b-MnLn5hoViqAej4kieJlA09pEQd-c9qPrxUlB4TNNIQ3DNyAU4XumBLOx1XKc5f-EzNaIFtTEww</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTREv1w3fD3VL-b6H1ucttf-3WZ1YBM9725C0cbhV87RosrWbzRj9b08oSfq3V25MJLAy30_wst_WbXhtxFSDa_MyzgkpWWOkPcGAFGMbg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTREv1wssTlG0nUbbyBvXJOHb9kwnHxgBMebveEeD0bOulz4gN625SBTAKi0KjExxr4qdqFlvOVXygIzq0KXOU5ni16Vu4_BSrsGhRtCiA</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTREv1wwaF3RK0pf0VjkvfwLphjzORMbEdBP59qonBEpQl5CSA19-AYLQewqoe3idvkjXSPoj8pZyVShr4qmOKLIU5xXt-q80W_fpIDbPA</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTREv1wxqZLG1x_DUJLJ1na4Jem2h3GRvY-MCSQcY0g_1hcZpZE8Smxc0xazxlZZHDjWdkZzlL7W9gzWAb5_z3V0xcfWQjcGFWGJwmdHQg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTREv1wyjbJ-Byc5BQzSdgEcEAb6vuS_cvgFPOJdw7OAFAKKWrTTRxmUj3iz0TOfUNxwzS-3PBn555PpUCCNRFcPTicRtmby1QZ-UP80Vw</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTREv1wzTjkFBbEII9FUZOCFSsJdp7OrQn5tmUIz0SCxGPaotWVZHJ_TZJjaKjTv_KqOAWJSQxsu-1GjsBsOwD5aOVZxX_56f3jQCBfOPg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Bebas+Neue&amp;display=swap</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://image.b.economist.com/lib/fe8d13727c61047f7c/m/1/13848c65-cacd-4b06-b65c-8e8cb5e32880.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.b.economist.com/lib/fe8d13727c61047f7c/m/1/8a56d00e-6b8b-401e-aba6-68c5bf58b95b.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.b.economist.com/lib/fe8d13727c61047f7c/m/1/a15b7372-2854-4b4b-990d-cfb66b2b7068.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.b.economist.com/lib/fe8d13727c61047f7c/m/1/ab334f2b-37e2-45de-9c86-b4e1e5053a7d.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.b.economist.com/lib/fe8d13727c61047f7c/m/1/eaabbcc4-dbed-49e2-8b58-a5127722f296.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.b.economist.com/lib/fe8d13727c61047f7c/m/1/ec45bdef-4596-473c-9d59-40723e073710.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://image.e.economist.com/lib/fe8d13727d62077d7d/m/1/eed89ab9-04c2-4912-b950-b230a95b82e6.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://view.b.economist.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://view.b.economist.com/?vawpToken=DMPWTWLXB7EUXGH4NCJH73FCGM.70252&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=https%3a%2f%2fview.b.economist.com%2f%3fvawpToken%3d</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://view.b.economist.com/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://view.b.economist.com/?vawpToken=</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://view.b.economist.com/?vawpToken=</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>http://image.e.economist.com/lib/fe8d13727d62077d7d/m/1/eed89ab9-04c2-4912-b950-b230a95b82e6.png</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/5.36.0/common/static/fonts/econsans-secondary-subset-bd.woff)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/5.36.0/common/static/fonts/econsans-secondary-subset-bd.woff2)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.15.0/common/static/fonts/economist-sans-italic.woff2)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.15.0/common/static/fonts/economist-sans-osf-italic.woff2)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.15.0/common/static/fonts/economist-sans-osf-roman.woff2)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.15.0/common/static/fonts/economist-sans-roman.woff2)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.15.0/common/static/fonts/economist-sans-sc-italic.woff2)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.15.0/common/static/fonts/economist-sans-sc-roman.woff2)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.15.0/common/static/fonts/economist-serif-italic.woff2)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.15.0/common/static/fonts/economist-serif-lf-italic.woff2)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.15.0/common/static/fonts/economist-serif-lf-roman.woff2)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.15.0/common/static/fonts/economist-serif-roman.woff2)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.15.0/common/static/fonts/economist-serif-sc-italic.woff2)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.15.0/common/static/fonts/economist-serif-sc-roman.woff2)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://click.b.economist.com/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTNGcvm0J2brHEcNzSd6COH4qBNd54P-60IsIgukRJj97pJuSCETZXK-LN81HA1StI_Ya1wrxSRWh3ZviEhB_B-uIW3IFAwP4NoDiHXkUw</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://click.b.economist.com/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTNGcvm1Yy3-6z__WzlhVMY2x-t9yWBdmpo18QRJksNXNvCEBulmllmi133BFtYr-ffz-TCObEoH4ISM9APsbBS-XZrFVroO_7vjXIAf3Q</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://click.b.economist.com/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTNGcvmz0r32cUmi007Z1uJqS-poRFar0GgSpu0n2qITxlxFKXbYE0WPhQXeAbFtGYdGwREf6bexR3bPn17Ha8yVnJ7arHasRer2ECUy8Q</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://click.b.economist.com/open.aspx?4-2225023-287090182-7295029-119-293523163-33&amp;d=70252&amp;bmt=0</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTNGcvm2febE7F4j6jOASqDAFX2BdXKbeHbk5m29rHNImXWpoMQXBKJt6sjS3uYqo2jcQcDImEcKCJ8QoITUghHU5wP275biInQgVskaqw</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTNGcvm3ulUfJFVsvyXlP86QqkAz6zgjWeG-5wj6xeIb38I0Pa_8kSTtVPqopxu9Z_kLXP8u1xbyXI_IU_OwUPN-T6Jtj9xgO9-PFioh5Q</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTNGcvm4kiv5ig5qYnWMPVbNFAkd7mj6DFR6-B6eMlFOzwfNMfRfZ4MesZulNQ3nTnKneHw8NADwFeLct_0lVGRfFo4cCxTe8r_ny4rxUA</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTNGcvm5Siisc3eL7xJ-xwhsz8pc_tKIF2y9XEEswOi5I75y9_3mUG1SCntOi-e9rMwYRYK9vtm6j09Kc7MI2pif9t2BA31wSh4V6e6Z-Q</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTNGcvm6E5EfbOYhazzgZ4L9iXQemNpmOsOxmLixzmYTjLO6WY4wvfx1SIoMhTVuCnptJQde_KaoGWQOp4QmS-jPlUggOw1tIRKWfIya1g</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTNGcvm7aCzwYbmZYOz5186SHYNgWmFN0Ev0uErX5Sx80d8C7hiwWebsFODXk01nhx2u7FpmEXKOsu-9BSDT33gkiHSll-1Q5-xpB4qnMQ</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTNGcvm8MRq_77P-lm28Z54_0PtdjkeCSBxuHFQcJnmp-q8uHyY3Z6l7HMxzRg_Mi-CqFlAF3BVyJAHG9Y7aqzkSRV4t2dNf83P7IJwcng</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTNGcvm9SP8VWpBQFCXraxPVGVMRoTUUtdCC2Q5icXbLlzPg4ZYB642UaCyG86QjkmsoEV_g2G9o4Fu85MAb5nRotq91IWDilsIxAt80zw</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://click.b.economist.com/u/?qs=ABB7InYiOjEsImQiOjQ5NzR9AAcAAAAABTNGcvmy9Q7i7kzNwEeFnYVPbcAnXxq1DS8A24JMu1Km5RbjPIqH6qwZrG3Wj98kaE3DP_rh6E6O4hNzfs2FjX7slgDFdgfjexGsEIyXag</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css2?family=Bebas+Neue&amp;display=swap</url>
              <origin>INPUT_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/bebasneue/v14/JTUSjIg69CK48gW7PXoo9WdhyyTh89ZNpQ.woff2')</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/bebasneue/v14/JTUSjIg69CK48gW7PXoo9WlhyyTh89Y.woff2')</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://image.b.economist.com/lib/fe8d13727c61047f7c/m/1/13848c65-cacd-4b06-b65c-8e8cb5e32880.png</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://image.b.economist.com/lib/fe8d13727c61047f7c/m/1/8a56d00e-6b8b-401e-aba6-68c5bf58b95b.png</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://image.b.economist.com/lib/fe8d13727c61047f7c/m/1/a15b7372-2854-4b4b-990d-cfb66b2b7068.png</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://image.b.economist.com/lib/fe8d13727c61047f7c/m/1/ab334f2b-37e2-45de-9c86-b4e1e5053a7d.png</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://image.b.economist.com/lib/fe8d13727c61047f7c/m/1/eaabbcc4-dbed-49e2-8b58-a5127722f296.png</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://image.b.economist.com/lib/fe8d13727c61047f7c/m/1/ec45bdef-4596-473c-9d59-40723e073710.png</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://pages.eiu.com/rs/753-RIQ-438/images/EconSansOSBol.woff');</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://pages.eiu.com/rs/753-RIQ-438/images/EconSansOSBolIta.woff');</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://pages.eiu.com/rs/753-RIQ-438/images/EconSansOSLig.woff');</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://pages.eiu.com/rs/753-RIQ-438/images/EconSansOSReg.woff');</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://pages.eiu.com/rs/753-RIQ-438/images/EconSansOSRegIta.woff');</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://pages.eiu.com/rs/753-RIQ-438/images/GT-Zirkon-Bold.woff)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://pages.eiu.com/rs/753-RIQ-438/images/GT-Zirkon-Medium.woff)</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://pages.eiu.com/rs/753-RIQ-438/images/GT-Zirkon-Medium.woff2</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://view.b.economist.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://view.b.economist.com/?vawpToken=DMPWTWLXB7EUXGH4NCJH73FCGM.70252&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=https%3a%2f%2fview.b.economist.com%2f%3fvawpToken%3d</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>cdn.design-system.economist.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>click.b.economist.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>BENIGN</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>image.b.economist.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>image.e.economist.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>pages.eiu.com</url>
              <origin>INPUT_FILE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>click.b.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>image.b.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>image.e.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>view.b.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>142.251.14.94</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>18.66.147.43</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>128.17.224.28</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>108.138.26.77</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>108.138.26.71</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>128.17.224.28</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>128.17.243.9</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.13.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>18.66.147.75</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.35.58.76</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>2cdbb534952e8f81014ef6bc7de9f7378a17cd126bbc3d36a4f8714fa73ac356</SHA-256>
              <SHA-1>d869f3137ba8a5550937b665594c52469f888031</SHA-1>
              <MD5>0166ce45458171caf457c2da658e271e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>1a5cba08936e036efef1aa51f65717024581e1da716bd152f577b3fc19f3f77e</SHA-256>
              <SHA-1>33df001a046e2e3df924976ee5320d5a1c504d0a</SHA-1>
              <MD5>78ee3a85a1cadc2815bc1a285183b017</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>0c2ceaeaac4cd3daabbf98a9e44ab3ed0adc0290a65e34cf21988e7923f2ba69</SHA-256>
              <SHA-1>c5e1951da70d993b236adc74aded1349a00bcbd7</SHA-1>
              <MD5>c1e0bb24422c7b7245bb24652e2be6f2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>13848c65-cacd-4b06-b65c-8e8cb5e32880</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>8a56d00e-6b8b-401e-aba6-68c5bf58b95b</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>a15b7372-2854-4b4b-990d-cfb66b2b7068</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>ab334f2b-37e2-45de-9c86-b4e1e5053a7d</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>eaabbcc4-dbed-49e2-8b58-a5127722f296</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>ec45bdef-4596-473c-9d59-40723e073710</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>eed89ab9-04c2-4912-b950-b230a95b82e6</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://view.b.economist.com/?vawpToken=DMPWTWLXB7EUXGH4NCJH73FCGM.70252&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=https%3a%2f%2fview.b.economist.com%2f%3fvawpToken%3d%%tokenized_vawp_metadata%%&amp;id_mc=293523163&amp;utm_source=sfmc&amp;utm_term=&amp;utm_content=356736&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email</name>
        <report_id>6b42790a-898c-4ea4-9d91-3f3ced7d5ef2</report_id>
        <tags>
          <value>xml</value>
          <value>html</value>
          <value>png</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>00a06975ad6e2a32fbc647d6272a68818531db5086c345cd221bbe28e86e989f</id>
    <title>Analysis Report for 00a06975ad6e2a32fbc647d6272a68818531db5086c345cd221bbe28e86e989f</title>
    <updated>2026-08-20T21:04:31Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876c79f2677ae4d366d393</_id>
        <file_type>text/html</file_type>
        <flow_id>6a876bdc099a97c449ef4252</flow_id>
        <hash>00a06975ad6e2a32fbc647d6272a68818531db5086c345cd221bbe28e86e989f</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle</url>
              <origin>INPUT_FILE</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://about.instagram.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://about.instagram.com/about-us/careers</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://about.instagram.com/blog/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://about.meta.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://developers.facebook.com/docs/instagram</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://help.instagram.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://privacycenter.instagram.com/policies/cookies/?annotations[0]=explanation%2F3_companies_list</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4/y1/r/0NgMS-WPRTe.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4/y8/r/aDAEOprU9HP.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4/yE/r/qOpGi5rLECZ.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4/yI/r/iMDbt5jKgKT.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4/yJ/r/mrkP-U_R5Ue.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4/yL/r/QqP2W9xWp-2wYOeX0j6uN6.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4/yO/r/TYrXMbbspbI.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4/yP/r/rrCxjEFdRGj.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4/yQ/r/phhshD5-sc1.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4/yh/r/8cp5ohxX4Dl.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4/yp/r/UDEtOa0Hsm-.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4/yy/r/reYyb-SSn4k.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4i7514/yx/l/en_US/C57z898iv26aQcDFONXV02Ic7esnko15cJbiqiz2HoRoQ7FoQTcwzi8GSBvj8_FEnWoMaDFORh7F3BSaV-S7OueDp0eU_FqQ44ee0qnL2dG90HsKRmwkg6fWCRtKQGwG0ihEWUNC0RbN-Ui-Qx8lcabVTDOwgx-s7CoHnsVjQqltBeBhrWYOAv6SoDVph1swGHhSx_h2otzgdunJlmSYSlxu50UmUcr6BPouu8FxhceZaR68thKqLYr_uYLTacPlfAVsTAuun_h8ECZYBY4hBBEVPzG9h-JZCcc2ZP1MqbA8xtVANryZAdmh5DEndjkKeHWrECl3_n.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4i7M54/y4/l/en_US/TexcNHv8CF3.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4iJid4/yI/l/en_US/szybpGC1sLS.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4iMfC4/yD/l/en_US/6B6ExCw3duFTcf-0O6cLbIjNnTnAPHAP4dnnUjS_BeX01Ut0jEWncjGSR_169Kn2AOA7NezpHXgttpeNUmV6E67HnVrQ6F4LSCeLGFH8Ug8wma7ySFlKTjgURSS1OrajkDar.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4iP2C4/yO/l/en_US/dUMxDJ-fRoAQsjlmiPUuRgJ0CEsEgLDMDtiUiPhIsexRXiLxM0IL6HmaA0y63ysw4LsBbc-6MOAphvT3eCpmBZ4R6PKzAallKXHIca9VG-NTJnP74A6c4gzEC3MY3DZc3pKacweh9anlL9lprCs80Deqxx0_uye9hpj8k.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4iQvT4/yE/l/en_US/M-LBWHhsGRV.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4iRhO4/yg/l/en_US/FKz4TFiec0P.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4iW5G4/yx/l/en_US/MsMPhweMgXv.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4iYf14/ym/l/en_US/aMqqVa9MB1c.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4idBq4/yW/l/en_US/V5qSQxVP11w.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4ijWG4/yW/l/en_US/QZZd1OgdFw1.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4inh_4/yH/l/en_US/fknyPRau9DUxGqs4TOcBKx9-dBS8IpxGAQUHQlfhgj8zIWsi9Nf6PfrfLHbNLMWmrsE0Pktu170ve3Nc30dHCikm-Q6aNodDiMD5HsuiCTJd5SOQEKEXaGJ8DwBsqEPHSH1YNvnmk7jwSVrzE4xYn60F-AaMkd1CPMwg_6BzgyT8wIXeTjjJUNSMOrBZUKwq77A6aTraTw8LD94AUXRwDHCkV8R1onn-JtdZ7PJ775NzKCi2ScrsOfCedTPWK7a817LCfIEJxYiBYz5S8KjCFM-z_0Q2ncATCB6ghfjDQwNPdLlL_jGYNh9-DZBIN8j5Wu6jBGHRQa.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4itdT4/yi/l/en_US/L6Gkd2-Lcc-_6v7hpzz_CMHUrPRMPbjNhiFGHh9ozlMIWKnSy-RcvwnXAqzp11_JpCnLtysZp4wRJplKrpHDk9eLsDHy1NBEX_GJJDchOYIvREWpsLFeNguDWEa2rrgkTPQAKN3FCGXPd_I.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v5/yn/l/0,cross/QeL-O4ZNs8uWCNCFWkqK38F8momuZ_hrPfgQe914iiBfONMKn3YhINqU49pVNahkCk7_0U7gNXta8GzNiZ9AWV5Gs97xFZK--hBruhBENOpKm_.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/y4/r/QaBlI0OZiks.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/y9/r/1GOXakOP6QP.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/yJ/r/53X3pk-t2Gn.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/yO/r/Ny6hrBVLYjl.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/yQ/r/-pkMfchyeAZ.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/yn/r/Puw_9ASeZc1.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/help/1561485474074139</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/help/cancelcontracts</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/help/cancelcontracts?source=instagram.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/help/instagram/261704639352628</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/ig_xsite_user_info/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/ig_xsite_user_obid/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/password/reset/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/password/reset/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/ajax/bulk-route-definitions/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/ajax/bz?__a=1&amp;__ccg=MODERATE&amp;__comet_req=7&amp;__crn=comet.igweb.PolarisCAAIGLoginHomepageRoute&amp;__d=www&amp;__hs=20685.HYP%3Ainstagram_web_pkg.2.1...0&amp;__hsi=7676223139851467053&amp;__req=1&amp;__rev=1045657964&amp;__s=%3A%3Aym5bbw&amp;__spin_b=trunk&amp;__spin_r=1045657964&amp;__spin_t=1787259974&amp;__user=0&amp;dpr=1&amp;jazoest=22307&amp;lsd=AdTRJERNheDEpukwQM0tc4H4mYQ&amp;ph=C3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/ajax/bz?__a=1&amp;__ccg=MODERATE&amp;__comet_req=7&amp;__crn=comet.igweb.PolarisCAAIGLoginHomepageRoute&amp;__d=www&amp;__hs=20685.HYP%3Ainstagram_web_pkg.2.1...0&amp;__hsi=7676223139851467053&amp;__req=3&amp;__rev=1045657964&amp;__s=%3A%3Aym5bbw&amp;__spin_b=trunk&amp;__spin_r=1045657964&amp;__spin_t=1787259974&amp;__user=0&amp;dpr=1&amp;jazoest=22307&amp;lsd=AdTRJERNheDEpukwQM0tc4H4mYQ&amp;ph=C3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/ajax/bz?__a=1&amp;__ccg=MODERATE&amp;__comet_req=7&amp;__crn=comet.igweb.PolarisCAAIGLoginHomepageRoute&amp;__d=www&amp;__hs=20685.HYP%3Ainstagram_web_pkg.2.1...0&amp;__hsi=7676223139851467053&amp;__req=6&amp;__rev=1045657964&amp;__s=%3A%3Aym5bbw&amp;__spin_b=trunk&amp;__spin_r=1045657964&amp;__spin_t=1787259974&amp;__user=0&amp;dpr=1&amp;jazoest=22307&amp;lsd=AdTRJERNheDEpukwQM0tc4H4mYQ&amp;ph=C3&amp;qpl_active_flow_ids=175125627%2C516759801</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/ajax/qm/?__a=1&amp;__user=0&amp;__comet_req=7&amp;jazoest=22307</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/data/manifest.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.meta.ai/?utm_source=foa_web_footer</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.threads.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>instagram.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=af</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=cs</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=da</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=de</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=el</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=es</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=fi</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=fr</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=hr</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=hu</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=id</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=it</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=ja</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=ko</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=ms</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=nb</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=nl</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=pl</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=pt</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=pt-br</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=ru</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=sk</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=sv</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=th</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=tl</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=tr</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=zh-cn</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=instagram&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163&amp;is_from_rle&amp;hl=zh-tw</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4/yE/r/T8xfahTKILL.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4/yE/r/qOpGi5rLECZ.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4/yp/r/UDEtOa0Hsm-.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4i7514/yx/l/en_US/C57z898iv26aQcDFONXV02Ic7esnko15cJbiqiz2HoRoQ7FoQTcwzi8GSBvj8_FEnWoMaDFORh7F3BSaV-S7OueDp0eU_FqQ44ee0qnL2dG90HsKRmwkg6fWCRtKQGwG0ihEWUNC0RbN-Ui-Qx8lcabVTDOwgx-s7CoHnsVjQqltBeBhrWYOAv6SoDVph1swGHhSx_h2otzgdunJlmSYSlxu50UmUcr6BPouu8FxhceZaR68thKqLYr_uYLTacPlfAVsTAuun_h8ECZYBY4hBBEVPzG9h-JZCcc2ZP1MqbA8xtVANryZAdmh5DEndjkKeHWrECl3_n.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4iMfC4/yD/l/en_US/6B6ExCw3duFTcf-0O6cLbIjNnTnAPHAP4dnnUjS_BeX01Ut0jEWncjGSR_169Kn2AOA7NezpHXgttpeNUmV6E67HnVrQ6F4LSCeLGFH8Ug8wma7ySFlKTjgURSS1OrajkDar.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4iP2C4/yO/l/en_US/dUMxDJ-fRoAQsjlmiPUuRgJ0CEsEgLDMDtiUiPhIsexRXiLxM0IL6HmaA0y63ysw4LsBbc-6MOAphvT3eCpmBZ4R6PKzAallKXHIca9VG-NTJnP74A6c4gzEC3MY3DZc3pKacweh9anlL9lprCs80Deqxx0_uye9hpj8k.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4iRhO4/yg/l/en_US/FKz4TFiec0P.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4iW5G4/yx/l/en_US/MsMPhweMgXv.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v4iYf14/ym/l/en_US/aMqqVa9MB1c.js</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/v5/yn/l/0,cross/QeL-O4ZNs8uWCNCFWkqK38F8momuZ_hrPfgQe914iiBfONMKn3YhINqU49pVNahkCk7_0U7gNXta8GzNiZ9AWV5Gs97xFZK--hBruhBENOpKm_.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/y4/r/QaBlI0OZiks.ico</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/y9/r/MptwNl-B2pS.webp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/yL/r/mMvhX4currF.webp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/yY/r/5OCV_xUyQ5h.webp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/yj/r/f01UdNyJjJj.webp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/yr/r/rzWiSjZRxk5.webp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://static.cdninstagram.com/rsrc.php/yw/r/icwX0xAk0pz.webp</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=af</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=cs</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=da</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=de</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=el</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=en</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=es</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=fi</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=fr</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=hr</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=hu</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=id</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=it</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=ja</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=ko</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=ms</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=nb</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=nl</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=pl</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=pt</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=pt-br</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=ru</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=sk</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=sv</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=th</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=tl</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=tr</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=zh-cn</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle&amp;hl=zh-tw</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>about.instagram.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>about.meta.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>developers.facebook.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>help.instagram.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>privacycenter.instagram.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>static.cdninstagram.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.instagram.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.meta.ai</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.threads.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>static.cdninstagram.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>www.instagram.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>157.240.253.174</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>157.240.253.63</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>57.144.244.1</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>157.240.253.63</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>157.240.253.174</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>46b71a614cffb7abe78e4db01f3a6f531e3d30ddd67573f988108bfa6ac6302a</SHA-256>
              <SHA-1>99b6c3a2f039a614ce7937fbbebf39f990f61c9e</SHA-1>
              <MD5>29e4a3ab7e52f0e12c64e979bd05e9f1</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>5e889c7f51a15e5e9d6874d08b899b5308a866d134ba4f212292c976cd24c9d2</SHA-256>
              <SHA-1>3468fd343dfd643c2eea7a9618ab5a6a3e186fb0</SHA-1>
              <MD5>4bac7a667b8cb8d285ce297db74cea7a</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>c0597edf00756f91877fc65e9d408774ec103b8cde5cb19ea4dc0795417f7e6b</SHA-256>
              <SHA-1>75d995a1502440ae8776b468db53c46f55309a50</SHA-1>
              <MD5>6f94040ed1ce34f9663ef69f3379061b</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>1f866e05aa135411c43cbf4f862845d0e36675362a20fe598ff359130692abe1</SHA-256>
              <SHA-1>973e23f9467b5313939301e36d3b395059337249</SHA-1>
              <MD5>831075f3ee47222a6a4c4c05d03703ed</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>c23caab1d68464a87d77c0403f1189706d3516934f0897c47bf10dfc0bef2e6a</SHA-256>
              <SHA-1>3e6b46762bc75d511401362ad8a8a2f3a086e68e</SHA-1>
              <MD5>54dcae4aacf7ca3d992f2335c27ca28c</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>98b894f59e1413c237ddeacf49e7f9db8cdbbe92bb82fca5df12e879810574cb</SHA-256>
              <SHA-1>01569e293aca709c48ba86ebf382433ce34d5434</SHA-1>
              <MD5>1901f2b831b074c029e5d35dde6351dc</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>ae3f32b101ab07154f98d5e11759b37373169f699b5f6886f6a45cf184964ee2</SHA-256>
              <SHA-1>fa0c92f5e195e52fb063033adef0c19f013c8c0c</SHA-1>
              <MD5>28031479b1cef752961cd97a4beee23b</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>52406130c332e7867a7048b12cbd7bc75bd77d30da4c604b5198bfcc9f377b7f</SHA-256>
              <SHA-1>310d4ae653c322e20d340577820eeb69f1694003</SHA-1>
              <MD5>52b8199455cca7fd005eb630a15e65f1</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>b387e1b4852ab07dcf26660d73898520c7b05fd0a98772c0e92e518f4f3dafe7</SHA-256>
              <SHA-1>9fcfc82d37865d52a68968e5b96346ca69251070</SHA-1>
              <MD5>572f5867d04f1d57dca4d66b42187666</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>20091c48090af80fa2eeb4c0eb7a3ac642b1fda2bdd489f79cc348c0c9cfd398</SHA-256>
              <SHA-1>a63170fb9fbcafdbb67a8cf53a322433317b7462</SHA-1>
              <MD5>379f8bec732a999d3e0c49f1e9fe2a80</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>1c301184-08e3-48fc-90d3-8e847de344dd</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>2f6ba746-8c19-4be5-be5b-2bf24aca6a6f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>F57C63BB-98BE-4B24-8ECC-51DD0B2F4190</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>ab64aed2-92c1-4a22-b32c-5d2dc46b5ea4</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://www.instagram.com/accounts/login/?next=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dinstagram%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163&amp;is_from_rle</name>
        <report_id>6c6d92a4-e63c-4ec9-bdf3-57460bd92729</report_id>
        <tags>
          <value>html</value>
          <value>base64</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>4c85445adedfdceaa5466ecd1792315ae5fd33702ef6cb8d357a2317a1be8282</id>
    <title>Analysis Report for 4c85445adedfdceaa5466ecd1792315ae5fd33702ef6cb8d357a2317a1be8282</title>
    <updated>2026-08-20T21:04:31Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876c4ff2677ae4d366d381</_id>
        <file_type>text/html</file_type>
        <flow_id>6a876bdc1d88974f46c40491</flow_id>
        <hash>4c85445adedfdceaa5466ecd1792315ae5fd33702ef6cb8d357a2317a1be8282</hash>
        <iocs>
          <urls>
            <value>
              <url>https://www.economistgroup.com/privacy-policy?utm_source=sfmc&amp;utm_term=&amp;utm_content=356745&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_content=356745&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/privacy-policy</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/privacy-policy?utm_source=sfmc&amp;utm_term=https%3a%2f%2fwww.economistgroup.com%2fprivacy-policy%3futm_source%3dsfmc%26utm_term%3d%26utm_content%3d356745%26utm_id%3d0dec9837-0599-4d3c-9b70-f049a253db59%26sfmc_activityid%3d2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3demail&amp;utm_content=356745&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>economist.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://economistfoundation.org/legal/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://ico.org.uk/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://ico.org.uk/concerns/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://images.ctfassets.net/2h5kbjx7tvqe/6gnyJV9gOcqUy9rIJYc7mQ/3b38788edccb2c0a2bc93f1ada3b559c/Economist_Intelligence_RGB.jpg</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://mail.google.com/mail/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://mail.google.com/mail/?view=cm%5Cu0026fs=1%5Cu0026tf=1%5Cu0026to=dataprivacy@economist.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://mail.google.com/mail/?view=cm&amp;fs=1&amp;tf=1&amp;to=dataprivacy@economist.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://privacyportal-eu.onetrust.com/webform/707e4ae3-b3a8-4f3d-b625-0523fa5f3b2a/208df1c8-4034-4577-9fed-c24c46aa6fbb</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/cookies-policy</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/terms-of-use</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://cmp-cdn.p.aws.economist.com/latest/cmp.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cmp-cdn.p.aws.economist.com/latest/configs/economistgroup.config.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/mms/v2/get_site_data</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/mms/v2/get_site_data?hasCsp=true&amp;href=https%3A%2F%2Fwww.economistgroup.com%2Fprivacy-policy&amp;account_id=1747</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/unified/4.40.2/gdpr-tcf.27718c8cb9d29947d2c1.bundle.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/unified/wrapperMessagingWithoutDetection.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/wrapper/v2/messages</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/wrapper/v2/messages?hasCsp=true&amp;env=prod&amp;body=%7B%22accountId%22%3A1747%2C%22campaignEnv%22%3A%22prod%22%2C%22campaigns%22%3A%7B%22gdpr%22%3A%7B%22consentStatus%22%3A%7B%7D%2C%22targetingParams%22%3A%7B%7D%7D%7D%2C%22clientMMSOrigin%22%3A%22https%3A%2F%2Fconsent.economistgroup.com%22%2C%22hasCSP%22%3Atrue%2C%22includeData%22%3A%7B%22localState%22%3A%7B%22type%22%3A%22string%22%7D%2C%22actions%22%3A%7B%22type%22%3A%22RecordString%22%7D%2C%22cookies%22%3A%7B%22type%22%3A%22RecordString%22%7D%7D%2C%22propertyHref%22%3A%22https%3A%2F%2Fwww.economistgroup.com%2Fprivacy-policy%22%7D&amp;localState=null&amp;metadata=%7B%22gdpr%22%3A%7B%22applies%22%3Atrue%7D%7D&amp;nonKeyedLocalState=null&amp;ch=4473406174473406174253&amp;scriptVersion=4.40.2&amp;scriptType=unified</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/wrapper/v2/meta-data?hasCsp=true&amp;accountId=1747&amp;env=prod&amp;metadata=%7B%22gdpr%22%3A%7B%7D%7D&amp;propertyId=18882&amp;scriptVersion=4.40.2&amp;scriptType=unified</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/wrapper/v2/pv-data?hasCsp=true&amp;env=prod&amp;ch=4473406174473406174253&amp;scriptVersion=4.40.2&amp;scriptType=unified</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://economistfoundation.org/legal/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ico.org.uk/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ico.org.uk/concerns/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mail.google.com/mail/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://mail.google.com/mail/?view=cm&amp;fs=1&amp;tf=1&amp;to=dataprivacy@economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://privacyportal-eu.onetrust.com/webform/707e4ae3-b3a8-4f3d-b625-0523fa5f3b2a/208df1c8-4034-4577-9fed-c24c46aa6fbb</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://q3r0i2tyi0.execute-api.us-east-1.amazonaws.com/Prod/api/query</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect?v=2&amp;tid=G-WLMJ4XMTKT&amp;gtm=45je68j0v9185967532z8843324205za20gzb843324205zd843324205&amp;_p=1787259934939&amp;gcs=G101&amp;gcd=13m3n3m2m5l1&amp;npa=1&amp;dma_cps=-&amp;dma=1&amp;tcfd=1065b&amp;gdid=dMjkzMm&amp;are=1&amp;cid=1312328128.1787259936&amp;frm=0&amp;ngs=1&amp;pscdl=denied&amp;rcb=5&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;_s=1&amp;tag_exp=115938466~115938468~118897920~118897930~119367802~119367810~120213116~120315470~120385422&amp;sid=1787259935&amp;sct=1&amp;seg=0&amp;dl=https%3A%2F%2Fwww.economistgroup.com%2Fprivacy-policy%3Futm_source%3Dsfmc%26utm_term%3Dhttps%253a%252f%252fwww.economistgroup.com%252fprivacy-policy%253futm_source%253dsfmc%2526utm_term%253d%2526utm_content%253d356745%2526utm_id%253d0dec9837-0599-4d3c-9b70-f049a253db59%2526sfmc_activityid%253d2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%2526utm_medium%253demail%26utm_content%3D356745%26utm_id%3D0dec9837-0599-4d3c-9b70-f049a253db59%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail%26utm_campaign%3DMA00021495%26utm_medium%3Demail-owned%26utm_source%3Denterprise-marketing-cloud%26RefID%3D%26utm_term%3D20260820%26utm_id%3D2225023%26sfmc_id%3D00QWT00001258dX2AQ%26utm_content%3D%25%25%253dRedirectTo(%2540footerLink1)%253d%25%25%26id_mc%3D293523163&amp;dt=The%20Economist%20Group%20-%20Privacy%20Policy&amp;en=page_view&amp;_fv=1&amp;_ss=1&amp;tfd=1073</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/about-us.json?permalink=about-us</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/businesses.json?permalink=businesses</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/careers.json?permalink=careers</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/contact-us.json?permalink=contact-us</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/cookies-policy.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/esg.json?permalink=esg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/index.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/press-centre.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/results.json?permalink=results</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/terms-of-use.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/7ehbmdwmTc6gCImddmm1N/_buildManifest.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/7ehbmdwmTc6gCImddmm1N/_ssgManifest.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/205-20dff939fcd95ead.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/260-4edd13d637008e5e.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/29107295-1494f237b9e407ad.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/367.f06f1c6d5756b66f.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/612-c52df39d0cfa15e7.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/870-0ca8888e52f10df9.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/framework-bb5c596eafb42b22.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/main-ce1cb9c9c67787ef.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/pages/%5B...permalink%5D-7dd2665dc25356ab.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/pages/_app-18e38595f44eeeae.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/pages/index-3b76aa988f6ba795.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/pages/press-centre-3ab71dc07b4f5cf1.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/webpack-d9d123f27cb91a7d.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/css/7b7df489683ae8e4.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/css/d923685f123c42f6.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/media/EconSansOSLig.852fd301.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/media/EconSansOSMed.4193af1f.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/media/EconSansOSReg.c080dfc2.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/cookies-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/fonts/GT-Zirkon-Thin.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/privacy-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/privacy-policy?utm_source=sfmc&amp;utm_term=https%3a%2f%2fwww.economistgroup.com%2fprivacy-policy%3futm_source%3dsfmc%26utm_term%3d%26utm_content%3d356745%26utm_id%3d0dec9837-0599-4d3c-9b70-f049a253db59%26sfmc_activityid%3d2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3demail&amp;utm_content=356745&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/terms-of-use</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google-analytics.com/analytics.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect?v=1&amp;_v=j102&amp;aip=1&amp;a=1614738472&amp;t=pageview&amp;_s=1&amp;dl=https%3A%2F%2Fwww.economistgroup.com%2Fprivacy-policy%3Futm_source%3Dsfmc%26utm_term%3Dhttps%253a%252f%252fwww.economistgroup.com%252fprivacy-policy%253futm_source%253dsfmc%2526utm_term%253d%2526utm_content%253d356745%2526utm_id%253d0dec9837-0599-4d3c-9b70-f049a253db59%2526sfmc_activityid%253d2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%2526utm_medium%253demail%26utm_content%3D356745%26utm_id%3D0dec9837-0599-4d3c-9b70-f049a253db59%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail%26utm_campaign%3DMA00021495%26utm_medium%3Demail-owned%26utm_source%3Denterprise-marketing-cloud%26RefID%3D%26utm_term%3D20260820%26utm_id%3D2225023%26sfmc_id%3D00QWT00001258dX2AQ%26utm_content%3D%25%25%253dRedirectTo(%2540footerLink1)%253d%25%25%26id_mc%3D293523163&amp;ul=en-us&amp;dt=The%20Economist%20Group%20-%20Privacy%20Policy&amp;sr=800x600&amp;vp=1905x1080&amp;_u=YEBAAEABAAAAACAAI~&amp;jid=1130384459&amp;gjid=1535847949&amp;cid=1312328128.1787259936&amp;tid=UA-28292795-1&amp;_gid=922503274.1787259936&amp;_r=1&amp;_slc=1&amp;gtm=45He68j0n81N4859XBv843324205za200zd843324205&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616985~115938466~115938468~118897920~118897930~120315470~120385423&amp;npa=1&amp;z=1502083466</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-WLMJ4XMTKT&amp;cx=c&amp;gtm=4e68j0</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=GTM-N4859XB</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>mailto:customerservices@eiu.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:dataprivacy@economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.economistgroup.com/privacy-policy&amp;account_id=1747</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.economistgroup.com/privacy-policy?utm_source=sfmc&amp;utm_term=&amp;utm_content=356745&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_content=356745&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/privacy-policy?utm_source=sfmc&amp;utm_term=https%3a%2f%2fwww.economistgroup.com%2fprivacy-policy%3futm_source%3dsfmc%26utm_term%3d%26utm_content%3d356745%26utm_id%3d0dec9837-0599-4d3c-9b70-f049a253db59%26sfmc_activityid%3d2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3demail&amp;utm_content=356745&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>economistfoundation.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>ico.org.uk</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>images.ctfassets.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mail.google.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>privacyportal-eu.onetrust.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.economistgroup.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>cmp-cdn.p.aws.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>consent.economistgroup.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>economistfoundation.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ico.org.uk</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mail.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>privacyportal-eu.onetrust.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>q3r0i2tyi0.execute-api.us-east-1.amazonaws.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>region1.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.economistgroup.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>customerservices@eiu.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>dataprivacy@economist.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>141.193.213.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.64.155.119</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.37.175</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.32.121.107</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.13.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.139</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>216.239.32.36</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>52.222.214.84</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>65.8.131.56</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.33.187.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.64.150.81</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>192.178.183.19</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.66.174.246</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.13.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>3346579d486970acd998e93af5e824f09163023f60b441790b070f59183f96c8</SHA-256>
              <SHA-1>313c2b77c6ed79b758f50e756d9ce42f4c9ebdb0</SHA-1>
              <MD5>eacb3a20c1167f33e7bf0106fccd0a3e</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/jpeg</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>b8f935520ef1172c48b25992b986efbafd6b21718e4e3b66398be6893cd363c5</SHA-256>
              <SHA-1>d61d368e05772dda9cffcbc31103c3e635996318</SHA-1>
              <MD5>39456869250599a4d3f9e6fb3d0db31f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>e8f2ded5d74c0ee5f427a20b6715e65bc79ed5c4fc67fb00d89005515c8efe63</SHA-256>
              <SHA-1>ae56ea57c52d1153cec33cef91cf935d2d3af14d</SHA-1>
              <MD5>fbe36eb2eecf1b90451a3a72701e49d2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>6f689c36af983f3cc746b9709f4fdc37a3ed39b6279ddd30d352c5bbf656221b</SHA-256>
              <SHA-1>eb4dd2245fcbcabd9737950002955837d7dbd196</SHA-1>
              <MD5>062d349eea66eeacdfab7434abab89e4</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>60605851147126f9d19ddc2c42fd2326a1e1cbfb663a6e12ed4714d2b19ffcae</SHA-256>
              <SHA-1>0df508c03dd97c60d5d13d938dabdb7f72599b38</SHA-1>
              <MD5>624ff3270e3b02414b5c7ef0512e2d85</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>2df897c491b999e5cd8f94058a73358381b752919cd5cf97affcbbc40a05655b</SHA-256>
              <SHA-1>278b9b9dbdf0aca007b84f566f7b336011822e16</SHA-1>
              <MD5>454eb933d167cba80f4fb104b9b5904d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>f7c0e79f75357568520f0d79480e7691118e90dbb1fba594cbdd113965cc9ecd</SHA-256>
              <SHA-1>5cdef4b7ae81970b4e94f95714493913abb4f8d4</SHA-1>
              <MD5>c3884d8a707b4f1174dccb2272798b56</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>cd896333b8d9377781faa8e4e2352f1abac50f93d02899cd67dcd318ab05ebf9</SHA-256>
              <SHA-1>dfb098ec37ef0648de05976b03b9b6744222e3d4</SHA-1>
              <MD5>51b6a9ca0736b5b7e99635c5f8451702</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>99904fa37e08f6d89a15d15334fce1edc05f7d8677e115ccb84c112b6eb74c99</SHA-256>
              <SHA-1>ea0a40fd87549bfb576b8f384ea7979dd8ef1177</SHA-1>
              <MD5>0bdafcd47e12065a6f9a0df2c79fb8d3</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>381fac18abe3557810ca67c17b9eb7cb155d2aafc0b3b3e437a0b821280dd521</SHA-256>
              <SHA-1>6317ddfdd218b653167c6bc91b56b441c7ee0f6c</SHA-1>
              <MD5>21c59e25c59c848003d87f595817e36d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
          <uuids>
            <value>
              <uuid>208df1c8-4034-4577-9fed-c24c46aa6fbb</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>707e4ae3-b3a8-4f3d-b625-0523fa5f3b2a</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://www.economistgroup.com/privacy-policy?utm_source=sfmc&amp;utm_term=https%3a%2f%2fwww.economistgroup.com%2fprivacy-policy%3futm_source%3dsfmc%26utm_term%3d%26utm_content%3d356745%26utm_id%3d0dec9837-0599-4d3c-9b70-f049a253db59%26sfmc_activityid%3d2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3demail&amp;utm_content=356745&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=%%%3dRedirectTo(%40footerLink1)%3d%%&amp;id_mc=293523163</name>
        <report_id>2f2b7cca-1ea7-4304-997f-b11e24680963</report_id>
        <tags>
          <value>html</value>
          <value>jpg</value>
          <value>obfuscated</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>8646856d1227d5b9637c2a441f00320c932a2c084d1261d50dbeb2fb3ad0c7e9</id>
    <title>Analysis Report for 8646856d1227d5b9637c2a441f00320c932a2c084d1261d50dbeb2fb3ad0c7e9</title>
    <updated>2026-08-20T21:04:31Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876c44f2677ae4d366d37d</_id>
        <file_type>text/html</file_type>
        <flow_id>6a876bdc1d88974f46c40492</flow_id>
        <hash>8646856d1227d5b9637c2a441f00320c932a2c084d1261d50dbeb2fb3ad0c7e9</hash>
        <iocs>
          <urls>
            <value>
              <url>https://ampcid.google.com/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://ampcid.google.de/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/1/NRBR-6437288bef75de4b281</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/1/NRBR-6437288bef75de4b281?a=504517389&amp;v=1.320.1&amp;to=MhBSZQoZWRUCAkUMCwtaZ1QaPkUHDgRGChYOIEJYVzZSHhcLQkojICEfHiNWGUgQDUQCOQ%3D%3D&amp;rst=857&amp;ck=0&amp;s=2bac69f10e974bff&amp;ref=https://www.economist.com/pro&amp;ptid=90597879cdc4616d&amp;af=err,spa,xhr,stn,ins&amp;ap=5.061632&amp;be=300&amp;fe=415&amp;dc=344&amp;fsh=1&amp;perf=%7B%22timing%22:%7B%22of%22:1787259934719,%22n%22:0,%22r%22:1,%22re%22:56,%22f%22:56,%22dn%22:56,%22dne%22:56,%22c%22:56,%22s%22:56,%22ce%22:56,%22rq%22:56,%22rp%22:301,%22rpe%22:475,%22di%22:498,%22ds%22:644,%22de%22:644,%22dc%22:713,%22l%22:714,%22le%22:715%7D,%22navigation%22:%7B%22rc%22:2%7D%7D&amp;fp=492&amp;fcp=492</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/browser/blobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/browser/blobs?browser_monitoring_key=NRBR-6437288bef75de4b281&amp;type=BrowserSessionChunk&amp;app_id=504517389&amp;protocol_version=0&amp;timestamp=1787259934725&amp;attributes=entityGuid%3DMjYwOTk3NXxCUk9XU0VSfEFQUExJQ0FUSU9OfDUzODYzOTUzMw%26harvestId%3D2bac69f10e974bff_90597879cdc4616d_1%26trace.firstTimestamp%3D1787259934725%26trace.lastTimestamp%3D1787259935652%26trace.nodes%3D141%26trace.originTimestamp%3D1787259934725%26agentVersion%3D1.320.1%26firstSessionHarvest%3Dtrue%26ptid%3D90597879cdc4616d%26session%3D2bac69f10e974bff%26currentUrl%3Dhttps://www.economist.com/pro</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/events/1/NRBR-6437288bef75de4b281</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/events/1/NRBR-6437288bef75de4b281?a=504517389&amp;v=1.320.1&amp;to=MhBSZQoZWRUCAkUMCwtaZ1QaPkUHDgRGChYOIEJYVzZSHhcLQkojICEfHiNWGUgQDUQCOQ%3D%3D&amp;rst=930&amp;ck=0&amp;s=2bac69f10e974bff&amp;ref=https://www.economist.com/pro&amp;ptid=90597879cdc4616d</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/events/1/NRBR-6437288bef75de4b281?a=504517389&amp;v=1.320.1&amp;to=MhBSZQoZWRUCAkUMCwtaZ1QaPkUHDgRGChYOIEJYVzZSHhcLQkojICEfHiNWGUgQDUQCOQ%3D%3D&amp;rst=968&amp;ck=0&amp;s=2bac69f10e974bff&amp;ref=https://www.economist.com/pro&amp;ptid=90597879cdc4616d</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/events/1/NRBR-6437288bef75de4b281?a=504517389&amp;v=1.320.1&amp;to=MhBSZQoZWRUCAkUMCwtaZ1QaPkUHDgRGChYOIEJYVzZSHhcLQkojICEfHiNWGUgQDUQCOQ%3D%3D&amp;rst=969&amp;ck=0&amp;s=2bac69f10e974bff&amp;ref=https://www.economist.com/pro&amp;ptid=90597879cdc4616d</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/jserrors/1/NRBR-6437288bef75de4b281</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/jserrors/1/NRBR-6437288bef75de4b281?a=504517389&amp;v=1.320.1&amp;to=MhBSZQoZWRUCAkUMCwtaZ1QaPkUHDgRGChYOIEJYVzZSHhcLQkojICEfHiNWGUgQDUQCOQ%3D%3D&amp;rst=966&amp;ck=0&amp;s=2bac69f10e974bff&amp;ref=https://www.economist.com/pro&amp;ptid=90597879cdc4616d</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.2.1/common/static/fonts/economist-sans-osf-roman.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.2.1/common/static/fonts/economist-sans-roman.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cmp-cdn.p.aws.economist.com/latest/cmp.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cmp-cdn.p.aws.economist.com/latest/configs/economist.config.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/Notice.1c267.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/Notice.97af9.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/consent/tcfv2/vendor-list/categories?siteId=17470</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/consent/tcfv2/vendor-list/categories?siteId=17470&amp;consentLanguage=en</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/index.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/index.html?hasCsp=true&amp;message_id=1491396&amp;consentUUID=null&amp;consent_origin=https%3A%2F%2Fconsent.economist.com%2Fconsent%2Ftcfv2&amp;preload_message=true&amp;version=v1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/mms/v2/get_site_data</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/mms/v2/get_site_data?hasCsp=true&amp;href=https%3A%2F%2Fwww.economist.com%2Fpro&amp;account_id=1747</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/polyfills.01516.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/unified/4.40.2/gdpr-tcf.27718c8cb9d29947d2c1.bundle.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/unified/4.40.2/usnat-uspapi.090eccada574d39af6f8.bundle.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/unified/wrapperMessagingWithoutDetection.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/wrapper/v2/messages</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/wrapper/v2/messages?hasCsp=true&amp;env=prod&amp;body=%7B%22accountId%22%3A1747%2C%22campaignEnv%22%3A%22prod%22%2C%22campaigns%22%3A%7B%22gdpr%22%3A%7B%22consentStatus%22%3A%7B%7D%2C%22targetingParams%22%3A%7B%22isGroupSub%22%3Afalse%2C%22isApp%22%3Afalse%7D%7D%2C%22usnat%22%3A%7B%22consentStatus%22%3A%7B%7D%2C%22hasLocalData%22%3Afalse%2C%22targetingParams%22%3A%7B%22isGroupSub%22%3Afalse%2C%22isApp%22%3Afalse%7D%7D%7D%2C%22clientMMSOrigin%22%3A%22https%3A%2F%2Fconsent.economist.com%22%2C%22hasCSP%22%3Atrue%2C%22includeData%22%3A%7B%22localState%22%3A%7B%22type%22%3A%22string%22%7D%2C%22actions%22%3A%7B%22type%22%3A%22RecordString%22%7D%2C%22cookies%22%3A%7B%22type%22%3A%22RecordString%22%7D%7D%2C%22propertyHref%22%3A%22https%3A%2F%2Fwww.economist.com%2Fpro%22%7D&amp;localState=null&amp;metadata=%7B%22gdpr%22%3A%7B%22applies%22%3Atrue%7D%2C%22usnat%22%3A%7B%22applies%22%3Afalse%7D%7D&amp;nonKeyedLocalState=null&amp;ch=511422734522407215b4ab5231022787c63&amp;scriptVersion=4.40.2&amp;scriptType=unified</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/wrapper/v2/meta-data?hasCsp=true&amp;accountId=1747&amp;env=prod&amp;metadata=%7B%22gdpr%22%3A%7B%7D%2C%22usnat%22%3A%7B%7D%7D&amp;propertyId=17470&amp;scriptVersion=4.40.2&amp;scriptType=unified</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/06kdi_fe6w9jl.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/0jvhpaew_uadu.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/0ymus39n1c2ma.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/1jau1q35-9d7h.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/1kojrp_ttjae1.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/1sf22uoq8wpzm.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/1vhlz1e9xlhke.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/2_ib51ho-gg1-.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/2atg8yy5eh_9g.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/2iwpy9t3wy_md.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/2wbw69fv_mxgg.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/37rz2deupnlrm.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/39_702hz1etzx.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/3cpbrd3wco2ja.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/3r-12anb4cdj7.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/3yya1-cw6axc5.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/431h9ve15i3e6.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://enterprise.economist.com/static/e4c02c9/_next/static/chunks/turbopack-12qlw63e5bz75.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://images.ctfassets.net/kx6s83a63i8j/10zKNEPkMLyillnLJN2jUQ/0673a6aed5b504463c6039a972657887/the_economist_pro_icon_11_blue__2_.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://images.ctfassets.net/kx6s83a63i8j/2HcwjBbCqLYmAzucpLj189/7f73fc4e5a9afcdb53bb402979a6e41e/Microsoft-logo.png?fm=webp&amp;q=80</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://images.ctfassets.net/kx6s83a63i8j/2UhsLjS2Zmo7qG3m34cyIr/be0a6716561984a4b39a16a390a2b84e/the_economist_pro_icon_18_blue__1_.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://images.ctfassets.net/kx6s83a63i8j/5TAQlzpoGMmwgnTzkp6INe/c4eb73511785c070e621f5771a5f3ef0/the_economist_pro_FINALS_01.png?fm=webp&amp;q=80</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://images.ctfassets.net/kx6s83a63i8j/J3KQQx2vFtHE2Ft1Lv05r/e748cc508bf623f8a174aec03ad116ee/the_economist_pro_FINALS_02.png?fm=webp&amp;q=80</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://images.ctfassets.net/kx6s83a63i8j/TTYIIAqNpHi8u3N6NxlJX/51d33d9fc6a07e17cc4412ced9c517b2/450x210_Q4FlashSale2025_GenericOffer_SplashPage_V1.png?fm=webp&amp;q=80</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js-agent.newrelic.com/nr-spa-1.320.1.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://marber-cdn.economist.com/foundations/latest/fonts/economist-sans-italic.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://marber-cdn.economist.com/foundations/latest/fonts/economist-sans-roman.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://marber-cdn.economist.com/foundations/latest/fonts/economist-serif-italic.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://marber-cdn.economist.com/foundations/latest/fonts/economist-serif-roman.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://marber-cdn.economist.com/foundations/latest/images/brand-identifiers/economist-pro/logo-horizontal-red-light.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://marber-cdn.economist.com/foundations/latest/images/brand-identifiers/economist-pro/monogram-red-light.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://marber-cdn.economist.com/foundations/latest/images/brand-identifiers/economist-pro/signature-red.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://myaccount.economist.com/s/help</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://sourcepoint-portal.p.aws.economist.com/css/first-layer/gdpr/wall-reject.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.cloudflareinsights.com/beacon.min.js/v4513226cdae34746b4dedf0b4dfa099e1781791509496</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://subscribenow.economist.com/gift</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tags.tiqcdn.com/utag/teg/core/prod/utag.280.js?utv=ut4.51.202608130534</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tags.tiqcdn.com/utag/teg/core/prod/utag.348.js?utv=ut4.51.202608130534</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tags.tiqcdn.com/utag/teg/core/prod/utag.393.js?utv=ut4.51.202606040554</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tags.tiqcdn.com/utag/teg/core/prod/utag.425.js?utv=ut4.51.202608030711</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tags.tiqcdn.com/utag/teg/core/prod/utag.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=teg/core/202608130533&amp;cb=1787259935583</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economist.com/cdn-cgi/rum?</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economist.com/engassets/google-search-logo.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economist.com/group-subscriptions?utm_source=sfmc&amp;utm_term=headerLogo&amp;utm_content=356736&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=headerLogo&amp;id_mc=293523163#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economist.com/group-subscriptions?utm_source=sfmc&amp;utm_term=headerLogo&amp;utm_content=356736&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=headerLogo&amp;id_mc=293523163#main-content</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economist.com/privacyportal</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economist.com/pro</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economist.com/sitemap</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economist.com/subscribe</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economist.com/syndication</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/accessibility-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/cookies-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/esg/modern-slavery-act-statement</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/privacy-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/terms-of-use</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google-analytics.com/analytics.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-CWJ8XWVBYS</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-WL00EXBGPS&amp;cx=c&amp;gtm=4e68j0</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://consent.economist.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://consent.economist.com/consent/tcfv2&amp;preload_message=true&amp;version=v1</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.economist.com/pro&amp;account_id=1747</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.economist.com/pro&amp;ptid=90597879cdc4616d</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.economist.com/pro&amp;ptid=90597879cdc4616d&amp;af=err,spa,xhr,stn,ins&amp;ap=5.061632&amp;be=300&amp;fe=415&amp;dc=344&amp;fsh=1&amp;perf</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.economist.com/group-subscriptions?utm_source=sfmc&amp;utm_term=headerLogo&amp;utm_content=356736&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=headerLogo&amp;id_mc=293523163</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>ampcid.google.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>ampcid.google.de</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>bam.eu01.nr-data.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cdn.design-system.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cmp-cdn.p.aws.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>consent.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>enterprise.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>images.ctfassets.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>js-agent.newrelic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>marber-cdn.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>myaccount.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>sourcepoint-portal.p.aws.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>static.cloudflareinsights.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>subscribenow.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>tags.tiqcdn.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.economistgroup.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.16.79.73</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.39.232</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.42.19</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.32.121.47</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.33.187.102</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.35.58.101</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.110.100</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.13.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>143.204.181.43</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>162.247.243.39</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>172.64.144.42</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>172.64.152.219</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>185.221.87.23</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.101</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.138</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>52.222.214.77</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
          <uuids>
            <value>
              <uuid>0dec9837-0599-4d3c-9b70-f049a253db59</uuid>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <uuid>2f6ba746-8c19-4be5-be5b-2bf24aca6a6f</uuid>
              <origin>INPUT_FILE</origin>
            </value>
          </uuids>
        </iocs>
        <name>hxxps://www.economist.com/group-subscriptions?utm_source=sfmc&amp;utm_term=headerLogo&amp;utm_content=356736&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=headerLogo&amp;id_mc=293523163</name>
        <report_id>c3742389-3fee-4c85-a76b-44f92ea25047</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>31d2fa301c864163603cc20067b064e22f7f655ec6395fee4fc910c7fffca81a</id>
    <title>Analysis Report for 31d2fa301c864163603cc20067b064e22f7f655ec6395fee4fc910c7fffca81a</title>
    <updated>2026-08-20T21:04:31Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876c68f2677ae4d366d38b</_id>
        <file_type>text/html</file_type>
        <flow_id>6a876bdc5a70bef4cd150bf7</flow_id>
        <hash>31d2fa301c864163603cc20067b064e22f7f655ec6395fee4fc910c7fffca81a</hash>
        <iocs>
          <urls>
            <value>
              <url>go2.economist.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.cloudflare.com/5xx-error-landing?utm_source=errorcode_502&amp;utm_campaign=go2.economist.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/1/NRBR-03d1b0f971c028c91d7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/1/NRBR-03d1b0f971c028c91d7?a=520777919&amp;v=1.320.1&amp;to=MhBSZQoZC0UEUExcVwtaZ1QaPhdXCFZPWkoOIEJYVzYAThFZSxp/ICEfHiNWSxgWX01SZQ%3D%3D&amp;rst=981&amp;ck=0&amp;s=51ea233fa207d1f7&amp;ref=https://go2.economist.com/preference-centre&amp;ptid=b61d2f8f62e9a371&amp;tt=258d4dea1869c714&amp;af=err,spa,xhr,stn,ins&amp;ap=6.516236&amp;be=203&amp;fe=371&amp;dc=147&amp;fsh=1&amp;perf=%7B%22timing%22:%7B%22of%22:1787259974865,%22n%22:0,%22f%22:1,%22dn%22:1,%22dne%22:2,%22c%22:2,%22s%22:4,%22ce%22:11,%22rq%22:11,%22rp%22:203,%22rpe%22:224,%22di%22:340,%22ds%22:350,%22de%22:350,%22dc%22:572,%22l%22:572,%22le%22:574%7D,%22navigation%22:%7B%7D%7D&amp;fp=488&amp;fcp=488</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/browser/blobs</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/browser/blobs?browser_monitoring_key=NRBR-03d1b0f971c028c91d7&amp;type=BrowserSessionChunk&amp;app_id=520777919&amp;protocol_version=0&amp;timestamp=1787259974926&amp;attributes=entityGuid%3DMzY1MjgxOXxCUk9XU0VSfEFQUExJQ0FUSU9OfDUzODYwMTgwMQ%26harvestId%3D51ea233fa207d1f7_b61d2f8f62e9a371_1%26trace.firstTimestamp%3D1787259974926%26trace.lastTimestamp%3D1787259975897%26trace.nodes%3D188%26trace.originTimestamp%3D1787259974926%26agentVersion%3D1.320.1%26firstSessionHarvest%3Dtrue%26ptid%3Db61d2f8f62e9a371%26session%3D51ea233fa207d1f7%26currentUrl%3Dhttps://go2.economist.com/preference-centre</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/browser/blobs?browser_monitoring_key=NRBR-03d1b0f971c028c91d7&amp;type=BrowserSessionChunk&amp;app_id=520777919&amp;protocol_version=0&amp;timestamp=1787259975318&amp;attributes=entityGuid%3DMzY1MjgxOXxCUk9XU0VSfEFQUExJQ0FUSU9OfDUzODYwMTgwMQ%26harvestId%3D51ea233fa207d1f7_b61d2f8f62e9a371_2%26trace.firstTimestamp%3D1787259975318%26trace.lastTimestamp%3D1787259976113%26trace.nodes%3D19%26trace.originTimestamp%3D1787259974926%26agentVersion%3D1.320.1%26ptid%3Db61d2f8f62e9a371%26session%3D51ea233fa207d1f7%26currentUrl%3Dhttps://go2.economist.com/preference-centre</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/events/1/NRBR-03d1b0f971c028c91d7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/events/1/NRBR-03d1b0f971c028c91d7?a=520777919&amp;v=1.320.1&amp;to=MhBSZQoZC0UEUExcVwtaZ1QaPhdXCFZPWkoOIEJYVzYAThFZSxp/ICEfHiNWSxgWX01SZQ%3D%3D&amp;rst=1197&amp;ck=0&amp;s=51ea233fa207d1f7&amp;ref=https://go2.economist.com/preference-centre&amp;ptid=b61d2f8f62e9a371&amp;ht=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/events/1/NRBR-03d1b0f971c028c91d7?a=520777919&amp;v=1.320.1&amp;to=MhBSZQoZC0UEUExcVwtaZ1QaPhdXCFZPWkoOIEJYVzYAThFZSxp/ICEfHiNWSxgWX01SZQ%3D%3D&amp;rst=1199&amp;ck=0&amp;s=51ea233fa207d1f7&amp;ref=https://go2.economist.com/preference-centre&amp;ptid=b61d2f8f62e9a371&amp;ht=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/jserrors/1/NRBR-03d1b0f971c028c91d7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://bam.eu01.nr-data.net/jserrors/1/NRBR-03d1b0f971c028c91d7?a=520777919&amp;v=1.320.1&amp;to=MhBSZQoZC0UEUExcVwtaZ1QaPhdXCFZPWkoOIEJYVzYAThFZSxp/ICEfHiNWSxgWX01SZQ%3D%3D&amp;rst=1198&amp;ck=0&amp;s=51ea233fa207d1f7&amp;ref=https://go2.economist.com/preference-centre&amp;ptid=b61d2f8f62e9a371&amp;ht=1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.2.1/common/static/fonts/economist-sans-osf-roman.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.2.1/common/static/fonts/economist-sans-roman.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.42.1/common/static/fonts/economist-sans-roman.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.42.1/common/static/fonts/economist-serif-lf-roman.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cloud.b.economist.com/sfmc-preference-handler</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cmp-cdn.p.aws.economist.com/latest/cmp.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cmp-cdn.p.aws.economist.com/latest/configs/impact-autoload.config.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/Notice.1c267.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/Notice.97af9.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/consent/tcfv2/vendor-list/categories?siteId=34124</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/consent/tcfv2/vendor-list/categories?siteId=34124&amp;consentLanguage=en</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/index.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/index.html?hasCsp=true&amp;message_id=1457712&amp;consentUUID=null&amp;consent_origin=https%3A%2F%2Fconsent.economist.com%2Fconsent%2Ftcfv2&amp;preload_message=true&amp;version=v1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/mms/v2/get_site_data</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/mms/v2/get_site_data?hasCsp=true&amp;href=https%3A%2F%2Fimpact.economist.com.tcf%2Fpreference-centre&amp;account_id=1747</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/polyfills.01516.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/unified/4.40.2/gdpr-tcf.27718c8cb9d29947d2c1.bundle.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/unified/wrapperMessagingWithoutDetection.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/wrapper/v2/messages</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/wrapper/v2/messages?hasCsp=true&amp;env=prod&amp;body=%7B%22accountId%22%3A1747%2C%22campaignEnv%22%3A%22prod%22%2C%22campaigns%22%3A%7B%22gdpr%22%3A%7B%22consentStatus%22%3A%7B%7D%2C%22targetingParams%22%3A%7B%7D%7D%7D%2C%22clientMMSOrigin%22%3A%22https%3A%2F%2Fconsent.economist.com%22%2C%22hasCSP%22%3Atrue%2C%22includeData%22%3A%7B%22localState%22%3A%7B%22type%22%3A%22string%22%7D%2C%22actions%22%3A%7B%22type%22%3A%22RecordString%22%7D%2C%22cookies%22%3A%7B%22type%22%3A%22RecordString%22%7D%7D%2C%22propertyHref%22%3A%22https%3A%2F%2Fimpact.economist.com.tcf%2Fpreference-centre%22%7D&amp;localState=null&amp;metadata=%7B%22gdpr%22%3A%7B%22applies%22%3Atrue%7D%7D&amp;nonKeyedLocalState=null&amp;ch=496484564496484564921c&amp;scriptVersion=4.40.2&amp;scriptType=unified</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/wrapper/v2/meta-data?hasCsp=true&amp;accountId=1747&amp;env=prod&amp;metadata=%7B%22gdpr%22%3A%7B%7D%7D&amp;propertyId=34124&amp;scriptVersion=4.40.2&amp;scriptType=unified</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economist.com/wrapper/v2/pv-data?hasCsp=true&amp;env=prod&amp;ch=496484564496484564921c&amp;scriptVersion=4.40.2&amp;scriptType=unified</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://education.economist.com/enterprise#contact</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/assets/fonts/GTZirkon/GTZirkon-Thin.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/1968-2515d7d72076aee0.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/3827-183aa4475e07ccdd.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/4183-7e3eb1a842d77f15.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/425-7bc3bf6f167a7dbd.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/4281.996510cf2896ebda.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/4689.fa7e587b30de66c8.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/5587-fc5af8c76df14222.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/5598.580943e23884f310.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/5601-6a026fa9df044357.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/6126-8ec5778b67c674a2.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/6692-902c6cd62ce43406.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/6955-0aeaaa8c5e9870ac.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/7414.7a35815c803e0918.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/7583-806a461be0c7b8f3.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/87c73c54-e11922cda838f8cc.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/9080-0300c66359457c7d.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/9168-1cff035fc09939d9.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/app/%5B...slug%5D/error-008748f749ad1a68.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/app/%5B...slug%5D/page-c1eeb58f7cef9c62.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/app/layout-b0c8bca752c8d003.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/app/not-found-37ba4b705376c544.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/f4ea0107.3bc502eafa3c1472.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/main-app-49dce787dc571147.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/chunks/webpack-15cdd5bcba49dd98.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/css/8b81440241a917b2.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/css/93bd57c0321d2ff9.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/css/c7dd649ea2f4cf32.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/media/0c5bb9ee4ed3d7d4-s.p.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/media/18f6c1583eaf729c-s.p.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/media/3cf4c66034988ee9-s.p.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/media/52d4be79f7ac38ef-s.p.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/media/5d6e003851746dad-s.p.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/media/64a0e1945589e1d9-s.p.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/media/809e3ae469990c86-s.p.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/media/974d99b1f1dd173b-s.p.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/media/9f994194267c05b3-s.p.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/media/b4351c2c6be04547-s.p.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/media/bc8ed9c44e09a14a-s.p.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/media/c6f1277fbd84bb70-s.p.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/media/e3c3a8745aa27865-s.p.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/_next/static/media/f720320d43164490-s.p.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/i/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/preference-centre?t=ee399ed9-9708-442c-906c-bd9f7b0fd207&amp;utm_source=sfmc&amp;utm_term=unsubscribe_link&amp;utm_content=356743&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=unsubscribe_link&amp;id_mc=293523163</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://go2.economist.com/preference-centre?t=ee399ed9-9708-442c-906c-bd9f7b0fd207&amp;utm_source=sfmc&amp;utm_term=unsubscribe_link&amp;utm_content=356743&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=unsubscribe_link&amp;id_mc=293523163#privacy-manager</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://images.ctfassets.net/kijg0uivi3bw/1l3OLsLf9Ix6kRTFfQNf1P/980dc56cbe257c2f6ff34942bed651a0/Perspectives.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://images.ctfassets.net/kijg0uivi3bw/2Z1Wp9xdWa9GiOdo8ZImpX/6e677196c9d9e5f9bfb27bfbbdb0a0bf/EIU_Monthly_insights.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://images.ctfassets.net/kijg0uivi3bw/3FqOBkM6IqBqsHzaNVKt4z/a70e841143e13b60c39302d49d1b81ee/Impact-P_BackToBlue.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://images.ctfassets.net/kijg0uivi3bw/3wQULeA0IWIJFbt0xbX6DO/b2eea175dc050552491c4e673a130fc8/Impact_Newsletter_Centre_1280x720-EF1.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://images.ctfassets.net/kijg0uivi3bw/69Kr30r1wJBUpbLG7HOvrd/7d7b18465a019185eea934fbbae2c3a8/TEG_LOGO_RGB__1_.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://images.ctfassets.net/kijg0uivi3bw/7g4IikBgTj9qRwCO6SUixr/6748ff592e4509498704d6cda82b0653/EIU_FromOurChiefEconomist.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://impact.economist.com/contact</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js-agent.newrelic.com/nr-spa-1.320.1.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://privacyportal-eu.onetrust.com/webform/707e4ae3-b3a8-4f3d-b625-0523fa5f3b2a/208df1c8-4034-4577-9fed-c24c46aa6fbb</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://s.saleswingsapp.com/sw.prod.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://sourcepoint-portal.p.aws.economist.com/css/first-layer/gdpr/wall-reject.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://to.go.saleswingsapp.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economist.com/pro#contact</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/accessibility-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/cookies-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/esg/modern-slavery-act-statement</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/privacy-policy</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/terms-of-use</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistintelligence.com/contact-us/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=GTM-NLZ9XK6S</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://consent.economist.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://consent.economist.com/consent/tcfv2&amp;preload_message=true&amp;version=v1</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://go2.economist.com/preference-centre</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://go2.economist.com/preference-centre&amp;ptid=b61d2f8f62e9a371&amp;ht=1</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://go2.economist.com/preference-centre&amp;ptid=b61d2f8f62e9a371&amp;tt=258d4dea1869c714&amp;af=err,spa,xhr,stn,ins&amp;ap=6.516236&amp;be=203&amp;fe=371&amp;dc=147&amp;fsh=1&amp;perf</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://impact.economist.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://go2.economist.com/preference-centre?t=ee399ed9-9708-442c-906c-bd9f7b0fd207&amp;utm_source=sfmc&amp;utm_term=unsubscribe_link&amp;utm_content=356743&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=unsubscribe_link&amp;id_mc=293523163</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>bam.eu01.nr-data.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cdn.design-system.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cloud.b.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cmp-cdn.p.aws.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>consent.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>education.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>go2.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>images.ctfassets.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>impact.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>js-agent.newrelic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>privacyportal-eu.onetrust.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>s.saleswingsapp.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>sourcepoint-portal.p.aws.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>to.go.saleswingsapp.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.economistgroup.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.economistintelligence.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.cloudflare.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>104.18.36.171</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.43.214</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>128.17.212.90</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.32.121.107</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.32.121.40</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.33.187.2</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.35.58.54</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.13.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>162.247.243.39</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>185.221.87.23</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>52.222.214.84</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>65.9.130.75</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.16.123.96</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>7ccfbdb5fea6514d7fa7d778c55fad155ff454d0ffb9dfd24124a1aab3069d21</SHA-256>
              <SHA-1>46e26b89b05c8b14c980187383aa2ae4bdcdcfc6</SHA-1>
              <MD5>7fa2e369439da73268ec50e5a2ff6a5b</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>5a16efccd0125a527f5f82b5949061ff92a886fb8e043948746635ef4c7f633d</SHA-256>
              <SHA-1>d69f8a60ab7a4fe6a91d361444052a6ceab9897b</SHA-1>
              <MD5>cba447dbf709ad63b8c1abdbd7f57d21</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>5a960bbf784316043d2f7f1c89bff20f6e5704a0288854de47af7e6a985cb37b</SHA-256>
              <SHA-1>f5a74db63513df0d68970a16396d4d57ebdb1672</SHA-1>
              <MD5>b4c267ca2ccb873f8c367bfc5b571893</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://go2.economist.com/preference-centre?t=ee399ed9-9708-442c-906c-bd9f7b0fd207&amp;utm_source=sfmc&amp;utm_term=unsubscribe_link&amp;utm_content=356743&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=unsubscribe_link&amp;id_mc=293523163</name>
        <report_id>8f7bb3fd-93fd-4517-b09a-3e27fd368d4b</report_id>
        <tags>
          <value>html</value>
          <value>captcha</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>e0e9c32c3d4aa5ddf85ed8c808791e98ca6167865069c04283db3d2b7a43634c</id>
    <title>Analysis Report for e0e9c32c3d4aa5ddf85ed8c808791e98ca6167865069c04283db3d2b7a43634c</title>
    <updated>2026-08-20T21:04:31Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876c5af2677ae4d366d386</_id>
        <file_type>text/html</file_type>
        <flow_id>6a876bdc5a70bef4cd150bf8</flow_id>
        <hash>e0e9c32c3d4aa5ddf85ed8c808791e98ca6167865069c04283db3d2b7a43634c</hash>
        <iocs>
          <urls>
            <value>
              <url>https://l.facebook.com/l.php</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://l.facebook.com/l.php?u=http%3A%2F%2Fwww.economist.com%2F&amp;h=AUDalEa3IiNH03_jbCrwqL8bN0zjLN3PdkbFcv6rhMqiY7ZgDlUthk6cITkFWWe9qr6U5l4Zfq4P-yP6yB3nJfnbAQR8AH1y8IW4UMnMkc_B0YQ1yT-j-Y3w4xq_OhD-q36GtuYuouxilwo6pEGPgg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://l.facebook.com/l.php?u=https%3A%2F%2Ftransparency.meta.com%2Ffeatures%2Fexplaining-ranking%2F&amp;h=AUDH4rC0tTJABr2wFxFfuEK-hGKQRilTkb2zSpTQx-IVa2kpGCN01QH8f_fTDKp29EvFarU4cmitcO8LPHH9fmp_KOycXz4APxP9H4y1eVfsSTrTTyYoA4yW6UOFakHKlgLjkgopYeqYUix-12-bsQ</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://l.facebook.com/l.php?u=https%3A%2F%2Fwww.economistgroup.com%2Fcareers&amp;h=AUC36o1hFHcPhNFM1A5tZuOFCAP2_ke7uczt5h2IvfN-LDQ8p8TTwqKwB6yGSuhJCN97qGb3eeoLnPnfwuOuBMSh5Dt0Le57h3t0KEHKkK8r3jB5R-BRiCVuRytPckMT4kNjtIjfSRKaGYKBEkMsww</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://l.facebook.com/l.php?u=https%3A%2F%2Fwww.instagram.com%2Ftheeconomist&amp;h=AUD7MW0-KHZqq55y_uEW5BfyhRK8U1sgDwEQmJSYHpavwRfVWpqRjzyQv3fN2UmQJzQf6lwPTlT0K3nggENMJIvUrlt3cikAW6Lq5S6at7wVLXi9ST5xbxMTrV33CZsTS1DwLvO7Z_vVcpkoCaf2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://l.facebook.com/l.php?u=https%3A%2F%2Fx.com%2FTheEconomist&amp;h=AUAQSQc7XLisU6DAPJ-seYfDjCbt20eruvUAvXaNA_B-y0FBvAJyTGA2KDyIngUbwee91BViLBGbCbR3xVVf99xoMwLsHHeHLWeyJ8M1j-B8UqNRuOo7qOWO5xt_Jz6Dp5oxL51YnLDGTGdAuMwz</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra3-1.xx.fbcdn.net/v/t39.30808-1/756654639_27602892666045006_8011726390519001331_n.jpg?stp=c300.0.600.600a_cp0_dst-jpg_tt6&amp;cstp=mx600x600&amp;ctp=s32x32&amp;_nc_cat=108&amp;ccb=1-7&amp;_nc_sid=1d2534&amp;_nc_ohc=kcc_ZNKDvHUQ7kNvwEzQhBE&amp;_nc_oc=AdrTvpXbX5v3KmzPc34M842QERD_hB-1p0akjeF-W6G1x2AXr3BmnbhB-fsqXtxBYh8&amp;_nc_zt=24&amp;_nc_ht=scontent-fra3-1.xx&amp;_nc_gid=RvL9_bbcbKs1CsX65FPbvQ&amp;_nc_ss=78289&amp;oh=00_AQF1jjRDbAsb47lOQf8HH-b5C8vtuiUUWbWgkp6OB8BTMg&amp;oe=6A8D453A</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra3-1.xx.fbcdn.net/v/t39.99422-6/778664662_2125685818055585_7548143947268738767_n.png?stp=c0.89.1080.1080a_dst-jpg_tt6&amp;cstp=mx1080x1080&amp;ctp=s160x160&amp;_nc_cat=103&amp;ccb=1-7&amp;_nc_sid=09d16d&amp;_nc_ohc=KCyAv4ChLgkQ7kNvwG9hkG5&amp;_nc_oc=Adqfz9brWUFHUYQBSai6gMa4uATh0hWwe8ilVr5IOp5VZOGV6qRTKg2zmYMzr0cuH64&amp;_nc_zt=14&amp;_nc_ht=scontent-fra3-1.xx&amp;_nc_gid=SyjP3GDs6ELrTxsidtt5qA&amp;_nc_ss=78289&amp;oh=00_AQE3ylDeAi6Ew7wMxp2kJiliDuBzzm4y3sOF5UGEBVJqcA&amp;oe=6A8D4DA6</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra3-1.xx.fbcdn.net/v/t39.99422-6/778958055_27627234380305123_5229793866344128362_n.png?stp=c0.89.1080.1080a_dst-jpg_tt6&amp;cstp=mx1080x1080&amp;ctp=s160x160&amp;_nc_cat=101&amp;ccb=1-7&amp;_nc_sid=09d16d&amp;_nc_ohc=d_xkPZVSvx0Q7kNvwHIs5Vy&amp;_nc_oc=AdrZJAPpFncgoNr0mksahjaKaxTq-68L2ccMHXTgb1sBy4-HVyH02qIj8hyHL7n2rdU&amp;_nc_zt=14&amp;_nc_ht=scontent-fra3-1.xx&amp;_nc_gid=SyjP3GDs6ELrTxsidtt5qA&amp;_nc_ss=78289&amp;oh=00_AQHCtW24_MWPUacaNs2UuNfSFqoJy7nP50qmpJY2_1Wmxw&amp;oe=6A8D29DC</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra3-1.xx.fbcdn.net/v/t39.99422-6/779019188_1577214657191273_8270053961670931320_n.png?stp=c0.89.1080.1080a_dst-jpg_tt6&amp;cstp=mx1080x1080&amp;ctp=s160x160&amp;_nc_cat=108&amp;ccb=1-7&amp;_nc_sid=09d16d&amp;_nc_ohc=DNKSjivJmJMQ7kNvwF0o0AF&amp;_nc_oc=AdpuVagKO1NWFcVYsEfN6W61ZT-ebBU5b_dWcWmlr_X7-95moRlwOAXHfOYqn6KcbT8&amp;_nc_zt=14&amp;_nc_ht=scontent-fra3-1.xx&amp;_nc_gid=SyjP3GDs6ELrTxsidtt5qA&amp;_nc_ss=78289&amp;oh=00_AQG0GRdgVYpd-QbQK_Ud4BFGlpiOywuo2VAzszSLND5CiA&amp;oe=6A8D5582</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra3-1.xx.fbcdn.net/v/t39.99422-6/779050266_1607957427346333_4386986175734643209_n.png?stp=c0.89.1080.1080a_dst-jpg_tt6&amp;cstp=mx1080x1080&amp;ctp=s160x160&amp;_nc_cat=105&amp;ccb=1-7&amp;_nc_sid=09d16d&amp;_nc_ohc=E4iHreQLv88Q7kNvwEBYP9l&amp;_nc_oc=AdrKAKgwUaZ9PUTmElCwIdlb-fPnBI3BAr_-c9Te6v0cw7kM-ktsYbU3xGt7yi5WcHw&amp;_nc_zt=14&amp;_nc_ht=scontent-fra3-1.xx&amp;_nc_gid=SyjP3GDs6ELrTxsidtt5qA&amp;_nc_ss=78289&amp;oh=00_AQHcBLYw3itiAXZV7Yu5WsxwtjtRhdQAeARW-uLCt2ZGcQ&amp;oe=6A8D313F</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra3-2.xx.fbcdn.net/v/t39.99422-6/778950341_1748485259698475_6497920515148286841_n.png?stp=c0.89.1080.1080a_dst-jpg_tt6&amp;cstp=mx1080x1080&amp;ctp=s160x160&amp;_nc_cat=111&amp;ccb=1-7&amp;_nc_sid=09d16d&amp;_nc_ohc=kAvDZ3tdNfEQ7kNvwEkaFue&amp;_nc_oc=AdqPnHwmVe4tmQepUCs9fs0DO8Pjkt185c7bSNhYedrd2OmCMITyCpbvg5XkeHEMnC4&amp;_nc_zt=14&amp;_nc_ht=scontent-fra3-2.xx&amp;_nc_gid=SyjP3GDs6ELrTxsidtt5qA&amp;_nc_ss=78289&amp;oh=00_AQGKDHnvcYH4XWu9HrPZeFBjRw5qKJJrG9uSDtk809C8vw&amp;oe=6A8D330D</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra3-2.xx.fbcdn.net/v/t39.99422-6/778957672_1633586021706718_5837595810884304157_n.png?stp=c0.89.1080.1080a_dst-jpg_tt6&amp;cstp=mx1080x1080&amp;ctp=s160x160&amp;_nc_cat=104&amp;ccb=1-7&amp;_nc_sid=09d16d&amp;_nc_ohc=x5_DPgebGIgQ7kNvwErt7Dp&amp;_nc_oc=AdrtVcewdUltVit3a1jBUaAlEnmmYiwxcbTc0vgJ4OjxTKnWHJhezka2xw-WTQMzZPU&amp;_nc_zt=14&amp;_nc_ht=scontent-fra3-2.xx&amp;_nc_gid=SyjP3GDs6ELrTxsidtt5qA&amp;_nc_ss=78289&amp;oh=00_AQG3ODY0qK3VuiMRXjsEiHdvta_blI3SUETz_WclbRIouw&amp;oe=6A8D48BC</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra3-2.xx.fbcdn.net/v/t39.99422-6/781162839_1359725022912829_7917982621179306005_n.png?stp=c0.89.1080.1080a_dst-jpg_tt6&amp;cstp=mx1080x1080&amp;ctp=s160x160&amp;_nc_cat=111&amp;ccb=1-7&amp;_nc_sid=09d16d&amp;_nc_ohc=pH1c5hD2r4MQ7kNvwGKOnDm&amp;_nc_oc=AdqRKwrIGfDvmu6K5CF2blr2k49fTRwjc8csPydBtp9VfNodHKh_CR08YlTepqMlfjc&amp;_nc_zt=14&amp;_nc_ht=scontent-fra3-2.xx&amp;_nc_gid=SyjP3GDs6ELrTxsidtt5qA&amp;_nc_ss=78289&amp;oh=00_AQECWzaQO81_0yj_72eGUhLLwoSWQfqozZUpiPoPan7Y8A&amp;oe=6A8D59E6</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra5-2.xx.fbcdn.net/m1/v/t6/An-4eutqFWFfYhZPQR8tM2oP5E05jWW-J7tvfsD5wE23SUHSA2nXlg1n6fI_KpO3JoITC05bkD6cfuSRG3Fji57z_i1jO4Bw_K_ZEg.kf?_nc_gid=LQWtmljJXWAmnaBDo-5Ldw&amp;_nc_oc=AdpljZEJ47flDhBStnqGDoNY30DiHIxyVxnhLLAWSKHRndaysa88IB-65k8QddQqec8&amp;ccb=10-5&amp;oh=00_AQF00vU_gMQqaVVB258yHxj6pyIEMx4o7lQd90N0Y-24fQ&amp;oe=6AAEEB30&amp;_nc_sid=7da55a</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra5-2.xx.fbcdn.net/m1/v/t6/An-V1eo7VQ3O9lqK2f9nfo3p019W0b_BTfQk8m_WliRJfm8Ss0I6dO39oKJmajreEZ2Oy5vSrTbDg0GpAgj0NSk-Eu5PWtSAd1gv.kf?_nc_gid=LQWtmljJXWAmnaBDo-5Ldw&amp;_nc_oc=AdqD4xASIvchMJQ7qBDXQ5Qg3tD-gy_6clUgO-9fHxaAuzuG68Jo099JdPTPiDdFGag&amp;ccb=10-5&amp;oh=00_AQFri992f3IckE9NlCuXP40U1deOIODRnAYPvCqEk88O2Q&amp;oe=6AAEE771&amp;_nc_sid=7da55a</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra5-2.xx.fbcdn.net/m1/v/t6/An-epsBkaSJ4n9oYH6L6fSPKlfyvVNR_J7OfeV9-jqOZVx9-Fg73T8WyLTa1e_4iyoSboul40f-XChEvL3RtR-jyPuVfx7Umn4RlQyMS.kf?_nc_gid=LQWtmljJXWAmnaBDo-5Ldw&amp;_nc_oc=Ado3jSIoVRdKx1EpvLQQso_Udm4HBqwr7Sdi8Pb1LgQs_RB98QjTJmr4KBiXA3vp398&amp;ccb=10-5&amp;oh=00_AQF5YaJtP7fmvT0G_8a4nLfM4CcqcbZdeXAjd2uutvN5DA&amp;oe=6AAEE4C7&amp;_nc_sid=7da55a</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra5-2.xx.fbcdn.net/m1/v/t6/An-ltDiBj6BlExJAIyJiOGWs0CtdQwF9K9SyRSRhTIMgJd0MMzaw7ju3gnTsliPfba99uYjQem5sn3JzgpEnBVKOKfyfbcp-sMBJ.kf?_nc_gid=LQWtmljJXWAmnaBDo-5Ldw&amp;_nc_oc=AdrpZl7_WlnM-CIgdXa1Xi-RQcOgWiISoEDpiL_vYGNlW6AoysOdcqWYrxvzxEX2UbM&amp;ccb=10-5&amp;oh=00_AQHkVr8ZOt2OcfaXOPqM0CSCO8-Kujou5Zr8T0vJJd-6Eg&amp;oe=6AAECFD7&amp;_nc_sid=7da55a</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra5-2.xx.fbcdn.net/m1/v/t6/An8CYKC8XqtM-fkmXlVHrp9oVgPgDVVlGZu_Cy7Q_5xW9yYY3lOzMNVDCq9D1ThbbsbnpjfFmGnfIPhKX6oePvUMOYOvShQauKw.kf?_nc_gid=LQWtmljJXWAmnaBDo-5Ldw&amp;_nc_oc=Adr2w_E6wt-Xd-ld7S8iz72AgbntNNQ7DsRf4WXPIVPxW8egH-nr_s5c8jFsYWlCLwc&amp;ccb=10-5&amp;oh=00_AQFq59sBrq7Cz-dUn6eEBu56ey-BaAtb2BJMnw5E-uJsfw&amp;oe=6AAEEF4B&amp;_nc_sid=7da55a</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra5-2.xx.fbcdn.net/m1/v/t6/An8KSKhioMIUVSZ4NYh8JnAchGmGQVDA71Hulkn5JQZsO-ejSYcV2dWPMQo-ZhSa71MfFqgrDHlCASWFxgbtV3pYQqVdSus0zicQO6_n.kf?_nc_gid=LQWtmljJXWAmnaBDo-5Ldw&amp;_nc_oc=Adp6dzUQ-2tj8Qjl3OkbiHaG4L4KCsIGr0pk3OUrHMeUaOuNcnNLLk56vTzRirig3MM&amp;ccb=10-5&amp;oh=00_AQEEIsy_XpQaYFnFyaS02-bqh7cG1JXY9JCrLGpKokfbKQ&amp;oe=6AAEEAE6&amp;_nc_sid=7da55a</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra5-2.xx.fbcdn.net/m1/v/t6/An8UpDtYTxwRfyFUAQkYpPLVzCcFZAyT58b4mM9QRn-9IZWdHfcWsX1lOuHAsupZu8HCFEX8uobe6VdR6H9B8v2Z_FzSMfB8MYN36w.kf?_nc_gid=LQWtmljJXWAmnaBDo-5Ldw&amp;_nc_oc=AdoMgpTedp_QtnBLnRJGZXHyhWhFqnP029e2qMc8ZFYA4PSjrLV34W3EnV_uoHJG-mk&amp;ccb=10-5&amp;oh=00_AQGUeszK0dlvWi0OOKfL8Zse80zPD1obArJv_EEFDn_sVQ&amp;oe=6AAECD70&amp;_nc_sid=7da55a</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra5-2.xx.fbcdn.net/m1/v/t6/An_KOWvmE8xXhWbKcEDamiAQ14ZKS7T_w5aOTf-M8Krv4ls-f63eecRjpMEIRfwoMQw0XjeM4Q2PKoqtUSQc0_q66s2ahAGa0OTb.kf?_nc_gid=LQWtmljJXWAmnaBDo-5Ldw&amp;_nc_oc=AdpXJuIu1ZVx78STOuaY5LpR7TxbaRDLmQkJQmQsA69s1M0NmTT3xsNRXKeAa5Wac6k&amp;ccb=10-5&amp;oh=00_AQEd9rHNkIwjWRpe4FwjX_I7cyheOx1OelqjC2TboIt5gw&amp;oe=6AAEEB00&amp;_nc_sid=7da55a</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra5-2.xx.fbcdn.net/m1/v/t6/An_iJw3Cc3y5RtzEpR0M4CCznWN_ywjtFHZENvSbcomn6tH9EuRIjlfe7xaIpEOIEZAGHfQMVNlOPpkGNsG7fM8CslunKANTZ6ED.kf?_nc_gid=LQWtmljJXWAmnaBDo-5Ldw&amp;_nc_oc=Adq9VuCkVv8iv-HZ047SVvQ4cC8h0BaHk20HbWAHNtHP2C5YCFkdnkbZ6EgVYhUE_z0&amp;ccb=10-5&amp;oh=00_AQHtctcBm1-wz-XNZdWkS8x99Q-cwOgpWH6QofKkp_RG8A&amp;oe=6AAEC358&amp;_nc_sid=7da55a</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra5-2.xx.fbcdn.net/v/t39.30808-1/463657708_996937509131436_6524401843451309017_n.jpg?stp=cp0_dst-jpg_tt6&amp;cstp=mx1182x1182&amp;ctp=s40x40&amp;_nc_cat=1&amp;ccb=1-7&amp;_nc_sid=2d3e12&amp;_nc_ohc=PFTelgqC-Q4Q7kNvwFHF5Vu&amp;_nc_oc=AdpSN5K9yqQYbBMcbZfLdfGQ9BfDME9g4W-5dnurfti9cUIu0h_fLPGXyqXd3qzOUnI&amp;_nc_zt=24&amp;_nc_ht=scontent-fra5-2.xx&amp;_nc_gid=RvL9_bbcbKs1CsX65FPbvQ&amp;_nc_ss=78289&amp;oh=00_AQH9ZKM2nFe6zPQLb70szof9aJ6bAoCQhBsL8S2kAkhGaw&amp;oe=6A8D52D7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra5-2.xx.fbcdn.net/v/t39.30808-1/463657708_996937509131436_6524401843451309017_n.jpg?stp=cp0_dst-jpg_tt6&amp;cstp=mx1182x1182&amp;ctp=s40x40&amp;_nc_cat=1&amp;ccb=1-7&amp;_nc_sid=2d3e12&amp;_nc_ohc=PFTelgqC-Q4Q7kNvwFHF5Vu&amp;_nc_oc=AdpSN5K9yqQYbBMcbZfLdfGQ9BfDME9g4W-5dnurfti9cUIu0h_fLPGXyqXd3qzOUnI&amp;_nc_zt=24&amp;_nc_ht=scontent-fra5-2.xx&amp;_nc_gid=SyjP3GDs6ELrTxsidtt5qA&amp;_nc_ss=78289&amp;oh=00_AQGq3Aq2HKCMQ7WhSz4hmFplVOpX-8ktWIKDpeUricwZdw&amp;oe=6A8D52D7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra5-2.xx.fbcdn.net/v/t39.30808-1/463657708_996937509131436_6524401843451309017_n.jpg?stp=dst-jpg_tt6&amp;cstp=mx1182x1182&amp;ctp=s200x200&amp;_nc_cat=1&amp;ccb=1-7&amp;_nc_sid=2d3e12&amp;_nc_ohc=PFTelgqC-Q4Q7kNvwFHF5Vu&amp;_nc_oc=AdpSN5K9yqQYbBMcbZfLdfGQ9BfDME9g4W-5dnurfti9cUIu0h_fLPGXyqXd3qzOUnI&amp;_nc_zt=24&amp;_nc_ht=scontent-fra5-2.xx&amp;_nc_gid=SyjP3GDs6ELrTxsidtt5qA&amp;_nc_ss=78289&amp;oh=00_AQF3CsjUMjgbAK6YGo3Cf8hVDEukXjivO5tIcBAgLhvq0Q&amp;oe=6A8D52D7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra5-2.xx.fbcdn.net/v/t39.30808-1/463657708_996937509131436_6524401843451309017_n.jpg?stp=dst-jpg_tt6&amp;cstp=mx1182x1182&amp;ctp=s200x200&amp;_nc_cat=1&amp;ccb=1-7&amp;_nc_sid=f907e8&amp;_nc_ohc=PFTelgqC-Q4Q7kNvwFHF5Vu&amp;_nc_oc=AdpSN5K9yqQYbBMcbZfLdfGQ9BfDME9g4W-5dnurfti9cUIu0h_fLPGXyqXd3qzOUnI&amp;_nc_zt=24&amp;_nc_ht=scontent-fra5-2.xx&amp;_nc_gid=LQWtmljJXWAmnaBDo-5Ldw&amp;_nc_ss=78289&amp;oh=00_AQHBu8eQMrAE7Oq9LTjMDX8sVEOUAQavT87kfPsVNDrMLA&amp;oe=6A8D52D7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra5-2.xx.fbcdn.net/v/t39.99422-6/777221238_1616648806689571_2767267145966116809_n.png?stp=c0.131.1181.1181a_dst-jpg_tt6&amp;cstp=mx1181x1181&amp;ctp=s160x160&amp;_nc_cat=109&amp;ccb=1-7&amp;_nc_sid=09d16d&amp;_nc_ohc=sK5_4UWZ-qUQ7kNvwHr3ulu&amp;_nc_oc=AdowJh2TTuah3mTOQghV-z4vmGTEvKGLYPNriiVbNT29ib2S3vMRlkEwN4AfA5x4yNA&amp;_nc_zt=14&amp;_nc_ht=scontent-fra5-2.xx&amp;_nc_gid=SyjP3GDs6ELrTxsidtt5qA&amp;_nc_ss=78289&amp;oh=00_AQE4F3tcWlHJBKDQ1T3OpFE3Q0o9TlpFTjTVRmhB0NIujQ&amp;oe=6A8D2D82</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra5-2.xx.fbcdn.net/v/t39.99422-6/778950281_1012536718499882_1689571390930428380_n.png?stp=c0.89.1080.1080a_dst-jpg_tt6&amp;cstp=mx1080x1080&amp;ctp=s160x160&amp;_nc_cat=106&amp;ccb=1-7&amp;_nc_sid=09d16d&amp;_nc_ohc=dur-IKXkI30Q7kNvwHfgfcA&amp;_nc_oc=Adp5capo9xh-zXMEwEjrh-pJppi5ZqPoT98RJ1vmTXFWrGt9thRDFkM6v0z_rNUzLPo&amp;_nc_zt=14&amp;_nc_ht=scontent-fra5-2.xx&amp;_nc_gid=SyjP3GDs6ELrTxsidtt5qA&amp;_nc_ss=78289&amp;oh=00_AQEelSQIxamP_VyEoU8A2U_pqxkPQ22LimxXVlo2aPlZYA&amp;oe=6A8D2652</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent-fra5-2.xx.fbcdn.net/v/t39.99422-6/778950281_1012536718499882_1689571390930428380_n.png?stp=dst-jpg_tt6&amp;cstp=mx1080x1350&amp;ctp=s640x640&amp;_nc_cat=106&amp;ccb=1-7&amp;_nc_sid=127cfc&amp;_nc_ohc=dur-IKXkI30Q7kNvwHfgfcA&amp;_nc_oc=Adp5capo9xh-zXMEwEjrh-pJppi5ZqPoT98RJ1vmTXFWrGt9thRDFkM6v0z_rNUzLPo&amp;_nc_zt=14&amp;_nc_ht=scontent-fra5-2.xx&amp;_nc_gid=RvL9_bbcbKs1CsX65FPbvQ&amp;_nc_ss=78289&amp;oh=00_AQG2ySuSpfONDF09zIEmlAYnEV94nP7fzAt4v-MFE0XswA&amp;oe=6A8D2652</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://scontent.xx.fbcdn.net/hads-ak-prn2/1487645_6012475414660_1439393861_n.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4/y1/r/0NgMS-WPRTe.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4/y9/r/5A2ToqSIJ4n.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4/yA/r/CcvZr1DbdWd.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4/yK/r/IAt-7RYYECb.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4/yO/r/vfmL8AAi01A.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4/yT/r/9G2cunyczis.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4/yd/r/QpQ4ZveDLN4.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4/yg/r/U1D-X6jRXG4.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4/yi/r/rJGGp7BJ7jh.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4i-zr4/y1/l/en_US-j/8YBAKFXotcU.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4i0LN4/yY/l/en_US-j/MZea62b-Vgk.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4i5wC4/yZ/l/en_US-j/jAWjNLeelKF.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4i9bN4/y6/l/en_US-j/X9MDb26LueT.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4i9wx4/yu/l/en_US-j/DTF_ylKbosVCZ-TW49eE13WGXJiHCjP7LxddOrC19o6mnDgVm1as9BPZjMPcWUzndNkJKN3ehX1EAnEwvrV8qX7CD5QzNPCiUo3xcRBYxTvmeM78VkOZvRrtZ2OOLjtfzmSOamszLBBw9BMw8ODYmgHSUBSW93rlOs_Fohd6yYyQaWkEYui_5u-2U6rO0uTjUzUPtt7hj7szJP4ksh8_SRZKYkmgr3yOH8hPBg0.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4iCvG4/yY/l/en_US-j/rwwVNmiC9-X.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4iE7L4/yQ/l/en_US-j/KFJiFGdmskILSF6kN-2GoitB4tlMktX5gZZjDkXlXHKuqgW-TExmHc73iqkyBEL0bzfAozIMNFBkk1kqiTrnNWRCOmq97LhqYGUGSBvj8_FEnWtyl4z5lrsY_DuwVDdF1djslfGAB9vKIof06MpY9hlcPv1Bn7FomqJukBhRuYYy_sRt2hrTIfPG5rTS8r_-bqsbSWYJQU4PKzR4W-Qx8lcabVTD7vw4WEQhGwKgnH0o8ZXBivGL85JCVpvVKJZCcc2ZP1Mq8wypiAW_bfkonn-JtdZ7PJuYQLzwqm8BXAdmh5DEndjkKeHWrECl3_nCt-B81RAVhX.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4iFb_4/yF/l/en_US-j/xG4JeafwXZk.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4iJVq4/yp/l/en_US-j/aKTfQFeUU7t.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4iJrC4/yL/l/en_US-j/y7IGNgxBkGP.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4iUhI4/y1/l/en_US-j/kK9l_njIU5B.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4iYeD4/ys/l/en_US-j/cm5Y8Ch5DMB.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4iZMX4/yM/l/en_US-j/C45-7ph8aI2_xTXnD_lPGmHfVCxUi5rF_35Akt69qa-0EiSV3ylwPrq-qUNjVM9MNheJmaRpBaLSW9b-Qjnno2g2SQt2b2FLoQf.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4icAV4/yB/l/en_US-j/F025Z3848e0W8mwv9OFuhikuqUCLzgRA12AxvL0EvM5PQpTYZ4KBfTIkYE3QEEpPuTTnZioVQZKNW41Vk-2zIB3T7iWAHkCaJqb0oR-Fp94lE6.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4if_H4/y0/l/en_US-j/SyXwSJkLHxr.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4in__4/yr/l/en_US-j/g29Vz7gt71JehSUa_N_D9MHlBrhyTCkUTUfznCh536VbZ53YYHZzx7kbgXzTaewIBuDiXO0h74QbglfR3T5IT9zxEFBIU62OF1h809BrGBXPetg9xqXxzobB0jMVGcktGGRpNWWjlW6xEiITgJI0RlHD25ZU8ZNJN9NfM9BiO9FcPQ4rISRnDsjtJlv7YL5Ho0KV0VJi8cNzwSQ58.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v4itoc4/yW/l/en_US-j/aKjJ8LzlAQ-pZHWeXzDTX_TbneM1u-e8WQYsxIW5MT220to-Pfl8vyXehr62v62FL5J71_ueGJrVBCF5uCr-TKtLCvAQbZZOvWNizYKMderwI6djNHL2SkbWC82Yz_4vfOJLSGDLStvx5MhzuLEWRy94mjv_kkAv_-wGQ.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/v5/yN/l/0,cross/Sh4FUFCB5OcV0FcRB2uAxz7TF2-QXH5TPfgQe914iiBfvP3p6y_S61oONMKn3YhINqU49pVNahkCkeiF2w9Hlit1.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/y1/r/ay1hV6OlegS.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/y2/r/J7qLoeX5qTF.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/y2/r/U8mmifbPI69.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/yL/r/VLNVMYsRNQ9.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/yP/r/b_lEtPAUPMI.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/ya/r/Vr74Aw-hW7o.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/yg/r/DUjm2v1u572.kf</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/yk/r/Czs2nwUnhiR.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/yq/r/dRapf4XwOAD.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://static.xx.fbcdn.net/rsrc.php/ys/r/aH0ERWDLcje.webp</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/TheEconomist</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/TheEconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=facebook&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID=&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/TheEconomist/about</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/TheEconomist/followers/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/TheEconomist/following</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/TheEconomist/following/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/TheEconomist/photos</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/TheEconomist/posts/pfbid03678Bjy2FsaYjktiXsD8hFb6wEujpggVonB6fZe249QXKrUHHW4ZxFjaNY7GuS3GGl?__cft__[0]=AZaKK2np-Olo0EpMimLtA3Siul0rLLOjK5ujdBmwiKO6eqrBV4SiQIoFN3nUbTYN7CE_LyxldeJdoRpl6_SLbfMCY85qCp6lD3VdFju9PHXMkKwauoiiPWnHyrBdLz5Qp7rp5d31BOzB22iciQ7fUZ80Y5PrPuniXVTNDJWXidXmg6WSs_aL9h20vZM0IisnYrg&amp;__tn__=%2CO%2CP-R</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/TheEconomist/posts/pfbid03678Bjy2FsaYjktiXsD8hFb6wEujpggVonB6fZe249QXKrUHHW4ZxFjaNY7GuS3GGl?comment_id=4519043895078657&amp;__cft__[0]=AZaKK2np-Olo0EpMimLtA3Siul0rLLOjK5ujdBmwiKO6eqrBV4SiQIoFN3nUbTYN7CE_LyxldeJdoRpl6_SLbfMCY85qCp6lD3VdFju9PHXMkKwauoiiPWnHyrBdLz5Qp7rp5d31BOzB22iciQ7fUZ80Y5PrPuniXVTNDJWXidXmg6WSs_aL9h20vZM0IisnYrg&amp;__tn__=R-R</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/TheEconomist/reels_tab</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/TheEconomist?__cft__[0]=AZaKK2np-Olo0EpMimLtA3Siul0rLLOjK5ujdBmwiKO6eqrBV4SiQIoFN3nUbTYN7CE_LyxldeJdoRpl6_SLbfMCY85qCp6lD3VdFju9PHXMkKwauoiiPWnHyrBdLz5Qp7rp5d31BOzB22iciQ7fUZ80Y5PrPuniXVTNDJWXidXmg6WSs_aL9h20vZM0IisnYrg&amp;__tn__=%3C%3C%2CP-R</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/TheEconomist?__cft__[0]=AZaKK2np-Olo0EpMimLtA3Siul0rLLOjK5ujdBmwiKO6eqrBV4SiQIoFN3nUbTYN7CE_LyxldeJdoRpl6_SLbfMCY85qCp6lD3VdFju9PHXMkKwauoiiPWnHyrBdLz5Qp7rp5d31BOzB22iciQ7fUZ80Y5PrPuniXVTNDJWXidXmg6WSs_aL9h20vZM0IisnYrg&amp;__tn__=-UC%2CP-R</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/ajax/bootloader-endpoint/?modules=KeyframesRenderer%2CFBKeyframesLoggedSession%2CKeyframesAssetDecoder&amp;__aaid=0&amp;__user=0&amp;__a=1&amp;__req=4&amp;__hs=20685.HYP%3Acomet_loggedout_pkg.2.1...0&amp;dpr=1&amp;__ccg=EXCELLENT&amp;__rev=1045667353&amp;__s=%3A%3Agt5cwl&amp;__hsi=7676222966289186040&amp;__dyn=7xeUmwlEnwn8yEqxemh0no6u5U4e1Nxt3odEc8co2qwJyE24wJwpUe8hw2nVE4W0qa2OU7m0yE462mcwfG12wOx62G3i0Bo7O2l0Fwqo31w9a9wlo5qfK0zEkxe2Gewyw9G2SU4i5oe85nxmu3W0Gpo8o11E5C2-azo7u1qwPwbS16xi4UdUcobUak0KU566E4-6o4eEgwro9ob8aFqwIxW1owLwcO11zU0SS6EdoFo&amp;__csr=gB6CyCVF9bacnuWas5QTkQPGWBbekZz2iR9J4sK-JGqyOTSKjiykirlF6KqlkuQACGWp5hkbVkZ6bRTRqajWm6azF8-mXSppWx-azUCaAzp98Op5G8iyVriLyazUOuiu-dmuFk9xCqayoG9AFFpbUozHze55KqLz9Q2iax7zk4Gy5yrzbgCGVHzomByVU6Kq2K2S1mwDK3J5r42FUcVEyty81dU661Xlwr26xu1KAx-0Mk2G1rwTzFE0AS04280Kx02R81ooy04j40bUg17QrDgfQ0nu0qu1hw6xwb622ha0irw5RzE460ha6U0Subw8S0li0f7wcG0rO0kt1y9gK0dowa2093z8fElDbfo2qw3zErxTOw7x24Z3Fjwj2J01KO0ema03L6i0bGw0IVw2w604H80r_F1iec0PE2sz82Ywvo1to5im3Ocg9o2242Q2q1Mwa20A87m5pBa0r611ggwIw9a0pO0xz07Tokg0EJw17YE561-wn20bW1ayo3LovwhEO740Q83X3wS8ii88z0W0zazU2uwgU5TxK4k26chJSbBhapo4Gm0lt0KwN8587sM2ewm8W1gwp47Ki2-48C4E4idwXwEwoAE7C1mo2BS9yqxS17wpoGi7Vo7u0hq0WO28J2Wx1U0Dq3kkEN3EaEqgsU30wVwj86t0ByA1-wbG0seEa8cUwwc4VEJ1twcO15g2v80nOm2G4Ee44osBBw4SwEwEg6W07OExzEgg09v80mywlyw2Hpo1883Zw3w8yfgWsE2lg2iwroG0x40CQ15zE0kow8K5m1Ezo5m7o0we049E0UkU2bw4eKgB0dyi26u&amp;__hsdp=g8OW0A1RA1l2I2b954759hDV3O5coM9oSh5gyo4abgZyPENm5izkC64Q2aA6z5oq8de4ohwye0yo521mwQwOw8K1fJ08C4UfYwfEio9-EoyEl71k44AAhfzA0xE9U5yhwn84O1owuy1a1cwPwJw5gwYx60Qo2tw7HwQwso8E3awgU0izxy0g209Rw4Xy87S1Qw2C84m1SDwcy18wWx61kw9iu0uy3e3C0IU760TU520Po56222C0c6xq5E8o1po&amp;__hblp=0de1do5u1Wwywk80zaUc8dU26wdW4U4-3e4UaGxy13wYw9m2u1oAwnE5qcwgo20wn8ap86i5812o1a82lw56wai3i1NxadU3awMw2iU2mw7qx61bw823e0dAwlo7CU4u1bw8e1Myo1uEy3O0sK2-5ooDxm1-DwFwko1r8cU2vwjo760yA0F82NxK6U6K58sz8fo1dbwTl0zzQ3u0L8brxShG9Cg7m6U2Tw&amp;__sjsp=g8OW1Rbc7Cg5kaM8IAkgskB7nAf8kNz0Bx95gyoeC84UQURxkER91Bd0BgqwFg&amp;__comet_req=15&amp;__spin_r=1045667353&amp;__spin_b=trunk&amp;__spin_t=1787259934&amp;__crn=comet.fbweb.CometProfilePlusLoggedOutRoute</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/ajax/bulk-route-definitions/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/ajax/bz?__a=1&amp;__aaid=0&amp;__ccg=EXCELLENT&amp;__comet_req=15&amp;__crn=comet.fbweb.CometProfilePlusLoggedOutRoute&amp;__hs=20685.HYP%3Acomet_loggedout_pkg.2.1...0&amp;__hsi=7676222966289186040&amp;__req=1&amp;__rev=1045667353&amp;__s=%3A%3Agt5cwl&amp;__spin_b=trunk&amp;__spin_r=1045667353&amp;__spin_t=1787259934&amp;__user=0&amp;dpr=1&amp;jazoest=22432&amp;lsd=AdRNhUDb_Jg2EzIlkh2JqKruUpk&amp;ph=C3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/ajax/bz?__a=1&amp;__aaid=0&amp;__ccg=EXCELLENT&amp;__comet_req=15&amp;__crn=comet.fbweb.CometProfilePlusLoggedOutRoute&amp;__hs=20685.HYP%3Acomet_loggedout_pkg.2.1...0&amp;__hsi=7676222966289186040&amp;__req=2&amp;__rev=1045667353&amp;__s=%3A%3Agt5cwl&amp;__spin_b=trunk&amp;__spin_r=1045667353&amp;__spin_t=1787259934&amp;__user=0&amp;dpr=1&amp;jazoest=22432&amp;lsd=AdRNhUDb_Jg2EzIlkh2JqKruUpk&amp;ph=C3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/ajax/bz?__a=1&amp;__aaid=0&amp;__ccg=EXCELLENT&amp;__comet_req=15&amp;__crn=comet.fbweb.CometProfilePlusLoggedOutRoute&amp;__hs=20685.HYP%3Acomet_loggedout_pkg.2.1...0&amp;__hsi=7676222966289186040&amp;__req=3&amp;__rev=1045667353&amp;__s=%3A%3Agt5cwl&amp;__spin_b=trunk&amp;__spin_r=1045667353&amp;__spin_t=1787259934&amp;__user=0&amp;dpr=1&amp;jazoest=22432&amp;lsd=AdRNhUDb_Jg2EzIlkh2JqKruUpk&amp;ph=C3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/ajax/bz?__a=1&amp;__aaid=0&amp;__ccg=EXCELLENT&amp;__comet_req=15&amp;__crn=comet.fbweb.CometProfilePlusLoggedOutRoute&amp;__hs=20685.HYP%3Acomet_loggedout_pkg.2.1...0&amp;__hsi=7676222966289186040&amp;__req=7&amp;__rev=1045667353&amp;__s=%3A%3Agt5cwl&amp;__spin_b=trunk&amp;__spin_r=1045667353&amp;__spin_t=1787259934&amp;__user=0&amp;dpr=1&amp;jazoest=22432&amp;lsd=AdRNhUDb_Jg2EzIlkh2JqKruUpk&amp;ph=C3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/ajax/bz?__a=1&amp;__aaid=0&amp;__ccg=EXCELLENT&amp;__comet_req=15&amp;__crn=comet.fbweb.CometProfilePlusLoggedOutRoute&amp;__hs=20685.HYP%3Acomet_loggedout_pkg.2.1...0&amp;__hsi=7676222966289186040&amp;__req=a&amp;__rev=1045667353&amp;__s=%3A%3Agt5cwl&amp;__spin_b=trunk&amp;__spin_r=1045667353&amp;__spin_t=1787259934&amp;__user=0&amp;dpr=1&amp;jazoest=22432&amp;lsd=AdRNhUDb_Jg2EzIlkh2JqKruUpk&amp;ph=C3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/ajax/qm/?__a=1&amp;__user=0&amp;__comet_req=15&amp;jazoest=22432</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/data/manifest/?is_workplace_mobile_pwa_dogfooding=0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/help/1561485474074139</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/images/cookies/cookie_info_card_image_1.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/images/cookies/cookie_info_card_image_2.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/images/cookies/cookie_info_card_image_3.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/images/cookies/cookie_info_card_image_4.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/images/icons/FBLogo_Blueprint.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/legal/terms/information_about_page_insights_data</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/login/device-based/regular/login/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/login/device-based/regular/login/?login_attempt=1&amp;next=https%3A%2F%2Fwww.facebook.com%2FTheEconomist%2F%3Futm_source%3Denterprise-marketing-cloud%26utm_term%3D20260820%26utm_content%3Dfacebook%26utm_id%3D2225023%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail-owned%26utm_campaign%3DMA00021495%26RefID%3D%26sfmc_id%3D00QWT00001258dX2AQ%26id_mc%3D293523163</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/mduduzi.sibisi.142?comment_id=Y29tbWVudDoxNTgwMTEyNzMwODEzOTA4XzQ1MTkwNDM4OTUwNzg2NTc%3D&amp;__cft__[0]=AZaKK2np-Olo0EpMimLtA3Siul0rLLOjK5ujdBmwiKO6eqrBV4SiQIoFN3nUbTYN7CE_LyxldeJdoRpl6_SLbfMCY85qCp6lD3VdFju9PHXMkKwauoiiPWnHyrBdLz5Qp7rp5d31BOzB22iciQ7fUZ80Y5PrPuniXVTNDJWXidXmg6WSs_aL9h20vZM0IisnYrg&amp;__tn__=R-R</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/photo/?fbid=1580112680813913&amp;set=a.361010189390841&amp;__cft__[0]=AZaKK2np-Olo0EpMimLtA3Siul0rLLOjK5ujdBmwiKO6eqrBV4SiQIoFN3nUbTYN7CE_LyxldeJdoRpl6_SLbfMCY85qCp6lD3VdFju9PHXMkKwauoiiPWnHyrBdLz5Qp7rp5d31BOzB22iciQ7fUZ80Y5PrPuniXVTNDJWXidXmg6WSs_aL9h20vZM0IisnYrg&amp;__tn__=EH-R</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/photo/?fbid=996937505798103&amp;set=a.361010172724176&amp;__tn__=%3C</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/policies/cookies/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/privacy/policies/cookies/?annotations[0]=explanation%2F3_companies_list</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/recover/initiate?ars=royal_blue_bar</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>http://www.economist.com/&amp;h=AUDalEa3IiNH03_jbCrwqL8bN0zjLN3PdkbFcv6rhMqiY7ZgDlUthk6cITkFWWe9qr6U5l4Zfq4P-yP6yB3nJfnbAQR8AH1y8IW4UMnMkc_B0YQ1yT-j-Y3w4xq_OhD-q36GtuYuouxilwo6pEGPgg</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://transparency.meta.com/features/explaining-ranking/&amp;h=AUDH4rC0tTJABr2wFxFfuEK-hGKQRilTkb2zSpTQx-IVa2kpGCN01QH8f_fTDKp29EvFarU4cmitcO8LPHH9fmp_KOycXz4APxP9H4y1eVfsSTrTTyYoA4yW6UOFakHKlgLjkgopYeqYUix-12-bsQ</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.economistgroup.com/careers&amp;h=AUC36o1hFHcPhNFM1A5tZuOFCAP2_ke7uczt5h2IvfN-LDQ8p8TTwqKwB6yGSuhJCN97qGb3eeoLnPnfwuOuBMSh5Dt0Le57h3t0KEHKkK8r3jB5R-BRiCVuRytPckMT4kNjtIjfSRKaGYKBEkMsww</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/theeconomist&amp;h=AUD7MW0-KHZqq55y_uEW5BfyhRK8U1sgDwEQmJSYHpavwRfVWpqRjzyQv3fN2UmQJzQf6lwPTlT0K3nggENMJIvUrlt3cikAW6Lq5S6at7wVLXi9ST5xbxMTrV33CZsTS1DwLvO7Z_vVcpkoCaf2</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://x.com/TheEconomist&amp;h=AUAQSQc7XLisU6DAPJ-seYfDjCbt20eruvUAvXaNA_B-y0FBvAJyTGA2KDyIngUbwee91BViLBGbCbR3xVVf99xoMwLsHHeHLWeyJ8M1j-B8UqNRuOo7qOWO5xt_Jz6Dp5oxL51YnLDGTGdAuMwz</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.facebook.com/TheEconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=facebook&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID=&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163</url>
              <origin>INPUT_FILE</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>l.facebook.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>scontent-fra3-1.xx.fbcdn.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>scontent-fra3-2.xx.fbcdn.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>scontent-fra5-2.xx.fbcdn.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>scontent.xx.fbcdn.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>static.xx.fbcdn.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>157.240.0.6</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>157.240.253.1</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>57.144.244.1</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>57.144.248.128</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
        </iocs>
        <name>hxxps://www.facebook.com/TheEconomist/?utm_source=enterprise-marketing-cloud&amp;utm_term=20260820&amp;utm_content=facebook&amp;utm_id=2225023&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email-owned&amp;utm_campaign=MA00021495&amp;RefID=&amp;sfmc_id=00QWT00001258dX2AQ&amp;id_mc=293523163</name>
        <report_id>db35331c-3f72-4beb-b3dd-abd1ee53c55d</report_id>
        <tags>
          <value>html</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>d957a66ed3943bf412d12a1d9386d308a3968bea81d87c73728fa00d689ec744</id>
    <title>Analysis Report for d957a66ed3943bf412d12a1d9386d308a3968bea81d87c73728fa00d689ec744</title>
    <updated>2026-08-20T21:04:31Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876c52f2677ae4d366d382</_id>
        <file_type>text/html</file_type>
        <flow_id>6a876bdc5a70bef4cd150bf9</flow_id>
        <hash>d957a66ed3943bf412d12a1d9386d308a3968bea81d87c73728fa00d689ec744</hash>
        <iocs>
          <urls>
            <value>
              <url>http://mediadirectory.economist.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.2.1/common/static/fonts/economist-sans-osf-roman.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cdn.design-system.economist.com/assets/7.2.1/common/static/fonts/economist-sans-roman.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cmp-cdn.p.aws.economist.com/latest/cmp.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cmp-cdn.p.aws.economist.com/latest/configs/economistgroup.config.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/Notice.1c267.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/Notice.97af9.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/consent/tcfv2/vendor-list/categories?siteId=18882</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/consent/tcfv2/vendor-list/categories?siteId=18882&amp;consentLanguage=en</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/index.html</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/index.html?hasCsp=true&amp;message_id=1165840&amp;consentUUID=null&amp;consent_origin=https%3A%2F%2Fconsent.economistgroup.com%2Fconsent%2Ftcfv2&amp;preload_message=true&amp;version=v1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/mms/v2/get_site_data</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/mms/v2/get_site_data?hasCsp=true&amp;href=https%3A%2F%2Fwww.economistgroup.com%2Fcontact-us&amp;account_id=1747</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/polyfills.01516.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/unified/4.40.2/gdpr-tcf.27718c8cb9d29947d2c1.bundle.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/unified/wrapperMessagingWithoutDetection.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/wrapper/v2/messages</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/wrapper/v2/messages?hasCsp=true&amp;env=prod&amp;body=%7B%22accountId%22%3A1747%2C%22campaignEnv%22%3A%22prod%22%2C%22campaigns%22%3A%7B%22gdpr%22%3A%7B%22consentStatus%22%3A%7B%7D%2C%22targetingParams%22%3A%7B%7D%7D%7D%2C%22clientMMSOrigin%22%3A%22https%3A%2F%2Fconsent.economistgroup.com%22%2C%22hasCSP%22%3Atrue%2C%22includeData%22%3A%7B%22localState%22%3A%7B%22type%22%3A%22string%22%7D%2C%22actions%22%3A%7B%22type%22%3A%22RecordString%22%7D%2C%22cookies%22%3A%7B%22type%22%3A%22RecordString%22%7D%7D%2C%22propertyHref%22%3A%22https%3A%2F%2Fwww.economistgroup.com%2Fcontact-us%22%7D&amp;localState=null&amp;metadata=%7B%22gdpr%22%3A%7B%22applies%22%3Atrue%7D%7D&amp;nonKeyedLocalState=null&amp;ch=4473406174473406174253&amp;scriptVersion=4.40.2&amp;scriptType=unified</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/wrapper/v2/meta-data?hasCsp=true&amp;accountId=1747&amp;env=prod&amp;metadata=%7B%22gdpr%22%3A%7B%7D%7D&amp;propertyId=18882&amp;scriptVersion=4.40.2&amp;scriptType=unified</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com/wrapper/v2/pv-data?hasCsp=true&amp;env=prod&amp;ch=4473406174473406174253&amp;scriptVersion=4.40.2&amp;scriptType=unified</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://economistenterprise.com/contact-us</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://economistfoundation.org/contact/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://economistfoundation.org/supporters/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://events.economist.com/about-us/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://impact.economist.com/contact-us/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://job-boards.eu.greenhouse.io/theeconomistgroup</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://myaccount.economist.com/s/contact-us</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://q3r0i2tyi0.execute-api.us-east-1.amazonaws.com/Prod/api/query</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://region1.google-analytics.com/g/collect?v=2&amp;tid=G-WLMJ4XMTKT&amp;gtm=45je68j0v9185967532z8843324205za20gzb843324205zd843324205&amp;_p=1787259934908&amp;gcs=G101&amp;gcd=13m3n3m2m5l1&amp;npa=1&amp;dma_cps=-&amp;dma=1&amp;tcfd=1065b&amp;gdid=dMjkzMm&amp;are=1&amp;cid=1460232993.1787259936&amp;frm=0&amp;ngs=1&amp;pscdl=denied&amp;rcb=7&amp;sr=800x600&amp;uaa=&amp;uab=&amp;uafvl=&amp;uam=&amp;uamb=0&amp;uap=Linux&amp;uapv=&amp;uaw=0&amp;ul=en-us&amp;_s=1&amp;tag_exp=115938466~115938468~118897920~118897930~119367802~119367810~120213116~120315470~120385422&amp;sid=1787259935&amp;sct=1&amp;seg=0&amp;dl=https%3A%2F%2Fwww.economistgroup.com%2Fcontact-us%3Futm_source%3Dsfmc%26utm_term%3Dhttps%253a%252f%252fwww.economistgroup.com%252fcontact-us%253futm_source%253dsfmc%2526utm_term%253d%2526utm_content%253d356745%2526utm_id%253d0dec9837-0599-4d3c-9b70-f049a253db59%2526sfmc_activityid%253d2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%2526utm_medium%253demail%26utm_content%3D356745%26utm_id%3D0dec9837-0599-4d3c-9b70-f049a253db59%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail%26utm_campaign%3DMA00021495%26utm_medium%3Demail-owned%26utm_source%3Denterprise-marketing-cloud%26RefID%3D%26utm_term%3D20260820%26utm_id%3D2225023%26sfmc_id%3D00QWT00001258dX2AQ%26utm_content%3D%25%25%253dRedirectTo(%2540footerLink3)%253d%25%25%26id_mc%3D293523163&amp;dt=The%20Economist%20Group%20-%20Contact%20us&amp;en=page_view&amp;_fv=1&amp;_ss=1&amp;tfd=1028</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://sourcepoint-portal.p.aws.economist.com/css/first-layer/gdpr/wall-reject.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://subscribenow.economist.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/about-us.json?permalink=about-us</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/businesses.json?permalink=businesses</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/careers.json?permalink=careers</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/contact-us.json?permalink=contact-us</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/esg.json?permalink=esg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/group-news.json?permalink=group-news</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/index.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/press-centre.json</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/data/7ehbmdwmTc6gCImddmm1N/results.json?permalink=results</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/7ehbmdwmTc6gCImddmm1N/_buildManifest.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/7ehbmdwmTc6gCImddmm1N/_ssgManifest.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/205-20dff939fcd95ead.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/260-4edd13d637008e5e.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/29107295-1494f237b9e407ad.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/367.f06f1c6d5756b66f.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/612-c52df39d0cfa15e7.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/870-0ca8888e52f10df9.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/framework-bb5c596eafb42b22.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/main-ce1cb9c9c67787ef.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/pages/%5B...permalink%5D-7dd2665dc25356ab.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/pages/_app-18e38595f44eeeae.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/pages/index-3b76aa988f6ba795.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/pages/press-centre-3ab71dc07b4f5cf1.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/chunks/webpack-d9d123f27cb91a7d.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/css/7b7df489683ae8e4.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/css/d923685f123c42f6.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/media/EconSansOSLig.852fd301.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/media/EconSansOSMed.4193af1f.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/_next/static/media/EconSansOSReg.c080dfc2.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/contact-us</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/contact-us?utm_source=sfmc&amp;utm_term=https%3a%2f%2fwww.economistgroup.com%2fcontact-us%3futm_source%3dsfmc%26utm_term%3d%26utm_content%3d356745%26utm_id%3d0dec9837-0599-4d3c-9b70-f049a253db59%26sfmc_activityid%3d2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3demail&amp;utm_content=356745&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/favicon.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/fonts/GT-Zirkon-Thin.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.google-analytics.com/analytics.js</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.google-analytics.com/j/collect?v=1&amp;_v=j102&amp;aip=1&amp;a=1349217877&amp;t=pageview&amp;_s=1&amp;dl=https%3A%2F%2Fwww.economistgroup.com%2Fcontact-us%3Futm_source%3Dsfmc%26utm_term%3Dhttps%253a%252f%252fwww.economistgroup.com%252fcontact-us%253futm_source%253dsfmc%2526utm_term%253d%2526utm_content%253d356745%2526utm_id%253d0dec9837-0599-4d3c-9b70-f049a253db59%2526sfmc_activityid%253d2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%2526utm_medium%253demail%26utm_content%3D356745%26utm_id%3D0dec9837-0599-4d3c-9b70-f049a253db59%26sfmc_activityid%3D2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3Demail%26utm_campaign%3DMA00021495%26utm_medium%3Demail-owned%26utm_source%3Denterprise-marketing-cloud%26RefID%3D%26utm_term%3D20260820%26utm_id%3D2225023%26sfmc_id%3D00QWT00001258dX2AQ%26utm_content%3D%25%25%253dRedirectTo(%2540footerLink3)%253d%25%25%26id_mc%3D293523163&amp;ul=en-us&amp;dt=The%20Economist%20Group%20-%20Contact%20us&amp;sr=800x600&amp;vp=1905x1080&amp;_u=YEBAAEABAAAAACAAI~&amp;jid=195259685&amp;gjid=152859989&amp;cid=1460232993.1787259936&amp;tid=UA-28292795-1&amp;_gid=1808405251.1787259936&amp;_r=1&amp;_slc=1&amp;gtm=45He68j0n81N4859XBv843324205za200zd843324205&amp;gcd=13l3l3l2l1l1&amp;dma_cps=a&amp;dma=1&amp;tag_exp=115616986~115938466~115938469~118897920~118897930~120315471~120385422&amp;npa=1&amp;z=1588760789</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtag/js?id=G-WLMJ4XMTKT&amp;cx=c&amp;gtm=4e68j0</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=GTM-N4859XB</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>mailto:careers@economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:editorialvacancies@economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:executiveeducation@economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:letters@economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://consent.economistgroup.com</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://consent.economistgroup.com/consent/tcfv2&amp;preload_message=true&amp;version=v1</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.economistgroup.com/contact-us&amp;account_id=1747</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.economistgroup.com/contact-us?utm_source=sfmc&amp;utm_term=&amp;utm_content=356745&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_content=356745&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/contact-us?utm_source=sfmc&amp;utm_term=https%3a%2f%2fwww.economistgroup.com%2fcontact-us%3futm_source%3dsfmc%26utm_term%3d%26utm_content%3d356745%26utm_id%3d0dec9837-0599-4d3c-9b70-f049a253db59%26sfmc_activityid%3d2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3demail&amp;utm_content=356745&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://www.economistgroup.com/contact-us?utm_source=sfmc&amp;utm_term=&amp;utm_content=356745&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_content=356745&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/contact-us</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://www.economistgroup.com/contact-us?utm_source=sfmc&amp;utm_term=https%3a%2f%2fwww.economistgroup.com%2fcontact-us%3futm_source%3dsfmc%26utm_term%3d%26utm_content%3d356745%26utm_id%3d0dec9837-0599-4d3c-9b70-f049a253db59%26sfmc_activityid%3d2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3demail&amp;utm_content=356745&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>http://mediadirectory.economist.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://economistenterprise.com/contact-us</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://economistfoundation.org/contact/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://economistfoundation.org/supporters/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>SUSPICIOUS</verdict>
            </value>
            <value>
              <url>https://events.economist.com/about-us/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://images.ctfassets.net/2h5kbjx7tvqe/2UWgUltKsACJSmK7nVV92Y/22079a174f376c87ab4ad1d4ffa37c42/ECOGROUP_P1_RGB.png</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://impact.economist.com/contact-us/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://job-boards.eu.greenhouse.io/theeconomistgroup</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://myaccount.economist.com/s/contact-us</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://subscribenow.economist.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/gtm.js?id=</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>cdn.design-system.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cmp-cdn.p.aws.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>consent.economistgroup.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>economistenterprise.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>economistfoundation.org</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>events.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>impact.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>job-boards.eu.greenhouse.io</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mediadirectory.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>myaccount.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>q3r0i2tyi0.execute-api.us-east-1.amazonaws.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>region1.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>sourcepoint-portal.p.aws.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>subscribenow.economist.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.economistgroup.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.google-analytics.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>economistenterprise.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>economistfoundation.org</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>events.economist.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>images.ctfassets.net</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>impact.economist.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>job-boards.eu.greenhouse.io</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>mediadirectory.economist.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>myaccount.economist.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>subscribenow.economist.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>careers@economist.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>editorialvacancies@economist.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>executiveeducation@economist.com</email>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <email>letters@economist.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>141.193.213.11</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.18.32.60</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>18.64.211.108</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.18.40.249</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>172.64.145.218</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>13.33.187.102</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>65.9.130.37</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.21.36.94</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>104.18.37.175</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.32.121.107</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>13.35.58.54</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.13.97</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>172.64.144.42</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>192.178.183.101</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>216.239.32.36</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>52.222.214.77</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>65.8.131.129</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>104.18.36.119</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
            <value>
              <ip>142.251.13.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>47753c1d0ed88e3213c77c0b69cef05cf33c4569ac8f09ed780b83527cb9fac7</SHA-256>
              <SHA-1>605cdcaf54b1ed201a4523a89a68a29fd02785cb</SHA-1>
              <MD5>12676b7b5a90213a588991a7671a23a4</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>image/png</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>e8f2ded5d74c0ee5f427a20b6715e65bc79ed5c4fc67fb00d89005515c8efe63</SHA-256>
              <SHA-1>ae56ea57c52d1153cec33cef91cf935d2d3af14d</SHA-1>
              <MD5>fbe36eb2eecf1b90451a3a72701e49d2</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>481be21b81a17215cf7c34d06ca3029eaa5bda08d5606714e24c0baa43bc41a0</SHA-256>
              <SHA-1>751717cbe64580af37a2a3e4da9d6620df5ffb62</SHA-1>
              <MD5>76ca021667fcfff06f107f4f5a22451d</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>5e236c74e5b55b44c8a3e3bc2770d37415f0f761b5410722b3f1192fb1d7621b</SHA-256>
              <SHA-1>aebe0e081f2a5f758ca4c4cd072a06265f7c81da</SHA-1>
              <MD5>a8f22a711c8bfa1b79f6741a81bf38ed</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>d2b90049f8903b9b3d2ad116bdf6b78e08cd12b310c44ccc8dc42d652999a7e3</SHA-256>
              <SHA-1>ba557eb4349da55fc410cafdc21d58c553bd09ff</SHA-1>
              <MD5>1f29bb9b50c783bccc24751774358dfd</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>063ace2cc4d7b08f766057552bf8e22e147815f11bce19c19ef53bf1d9649f11</SHA-256>
              <SHA-1>dab14e81df5f29b68b0f707c1780b34bb4140064</SHA-1>
              <MD5>813d5264d3a452f45f75648bd39d9606</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>12f30c4955d2b8eb1c823ad425e7ffd21caf26f2fe3b7fee64052da3745e2309</SHA-256>
              <SHA-1>5260393607674a308253db4c658ddc37cfabbfb4</SHA-1>
              <MD5>892416d865e598c9d18e8f236cf73259</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>744a0f8d33fd1451cb8b8202746589bc202503876759878957ee1d127081c9ab</SHA-256>
              <SHA-1>9e2143a0d9ffb972dbaf88e7111eb79591bbbee2</SHA-1>
              <MD5>f7d186bd9ac3d1fa1f157093f96348c8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>8a2c8a798e0b57b06dbe71663015f6fbb247f6032071d44d02c6d639d6c907b1</SHA-256>
              <SHA-1>99f69adeb9bacb097820e8ca4067865af5dc2fa2</SHA-1>
              <MD5>d1c6621b0ae61f0ec3818eadd5ad7c64</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <SHA-256>78c7bd31e1a6345e1ad3d2871d637337fe76b0f6b4abffa727f482e83d31335b</SHA-256>
              <SHA-1>5101921230d207a381786a029adee98f5bb971a2</SHA-1>
              <MD5>3f05bc762df0fc6fb4a261adb78b0702</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://www.economistgroup.com/contact-us?utm_source=sfmc&amp;utm_term=https%3a%2f%2fwww.economistgroup.com%2fcontact-us%3futm_source%3dsfmc%26utm_term%3d%26utm_content%3d356745%26utm_id%3d0dec9837-0599-4d3c-9b70-f049a253db59%26sfmc_activityid%3d2f6ba746-8c19-4be5-be5b-2bf24aca6a6f%26utm_medium%3demail&amp;utm_content=356745&amp;utm_id=0dec9837-0599-4d3c-9b70-f049a253db59&amp;sfmc_activityid=2f6ba746-8c19-4be5-be5b-2bf24aca6a6f&amp;utm_medium=email&amp;utm_campaign=MA00021495&amp;utm_medium=email-owned&amp;utm_source=enterprise-marketing-cloud&amp;RefID=&amp;utm_term=20260820&amp;utm_id=2225023&amp;sfmc_id=00QWT00001258dX2AQ&amp;utm_content=%%%3dRedirectTo(%40footerLink3)%3d%%&amp;id_mc=293523163</name>
        <report_id>3b0c78f8-1a4c-4703-9932-00629e9c8506</report_id>
        <tags>
          <value>html</value>
          <value>png</value>
          <value>obfuscated</value>
          <value>captcha</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>ccc8df79618c078f2c56020ff2d1ec003cb9b95cc77753320f5307703b2f6cf9</id>
    <title>Analysis Report for ccc8df79618c078f2c56020ff2d1ec003cb9b95cc77753320f5307703b2f6cf9</title>
    <updated>2026-08-20T21:04:30Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876c7cf2677ae4d366d395</_id>
        <file_type>text/html</file_type>
        <flow_id>6a876bde0dfb99c1ceb05ce5</flow_id>
        <hash>ccc8df79618c078f2c56020ff2d1ec003cb9b95cc77753320f5307703b2f6cf9</hash>
        <iocs>
          <urls>
            <value>
              <url>https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_pzfy2abhlubh6bv_dyvwha2.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_lzfw9ovraljpmqc6m13khq2.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_iGr4o2yoBDyfwvXs2HIE3g2.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_fefa4e184d4076c9bb4f.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4bf24c4d450bd42ecb8f.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msauth.net/shared/1.0/content/js/oneDs_36c085e9e54fe9d23a54.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msauthimages.net/dbd5a2dd-erscu-8eslupa1vm7f3sp5zcsxfcguvcrsgbqp8rmt0/logintenantbranding/0/bannerlogo?ts=637396799357976274</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msauthimages.net/dbd5a2dd-erscu-8eslupa1vm7f3sp5zcsxfcguvcrsgbqp8rmt0/logintenantbranding/0/illustration?ts=637396792396526663</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_l_chUU-5ZYSVgQoZAiHKxw2.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://autologon.microsoftazuread-sso.com/aee6e3c9-711e-4c7c-bd27-04f2307db20d/winauth/ssoprobe?client-request-id=23cfa4ce-a2c8-4f9b-ade1-a3bafbd9a215&amp;_=1787259980146</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/$uxappimmutables.do?sysparm_request_type=ux_theme&amp;sysparm_app_config_sys_id=e42a5af4c700201072b211d4d8c2607c&amp;sysparm_app_sys_id=c86a62e2c7022010099a308dc7c26022&amp;sysparm_page_registry=a84adaf4c700201072b211d4d8c260b7&amp;uxpcb=NdA8RqyknPlvF/vpXJOVAXoxvwY=null</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/CTI%20Genesys%20Script%20Load%20Service%20Portal.jsdbx?c=9</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/ConditionalFocus.jsdbx?v=07-28-2026_2357&amp;c=37_1101</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/Dynatrace%20Script%20Load%20Service%20Portal.jsdbx?c=2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/ExcelJS.jsdbx?c=4</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/TinyMCESettingsShim.jsdbx?c=0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/Walkme%20Snippet%20Service%20Portal.jsdbx?c=92</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/aae4f7dc23330300c6bf121727bf6584.spcssdbx?c=123&amp;portal=81b75d3147032100ba13a5554ee4902b&amp;theme=281507c44317d210ca4c1f425db8f2fd&amp;uxf_theme_id=fad87d2ca304121029a4d1aed31e610f&amp;uxf_theme_variant_id=null</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/angular.do?sysparm_type=get_partial&amp;name=sn_banner.xml</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/api/now/sp/page?id=take_survey&amp;amp%3Binstance_id=2686790693fec7100dd8be7efaba10f6&amp;time=1787259976539&amp;portal_id=81b75d3147032100ba13a5554ee4902b&amp;request_uri=%2Fsp%3Fid%3Dtake_survey%26amp%3Binstance_id%3D2686790693fec7100dd8be7efaba10f6</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/api/now/sp/rectangle/79e5205bcb31120000f8d856634c9c5e?amp;instance_id=2686790693fec7100dd8be7efaba10f6&amp;id=take_survey</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/app_com.cxs.contextual_search.jsdbx?c=56</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/app_com.jsdbx?c=21</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/app_com.modelUtil.jsdbx?c=20</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/auth_redirect.do</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/auth_redirect.do?sysparm_stack=no&amp;sysparm_url=https%3A%2F%2Flogin.microsoftonline.com%2Faee6e3c9-711e-4c7c-bd27-04f2307db20d%2Fsaml2%3FSAMLRequest%3DlVJLj9MwEP4rke9JHPeR1GoqlVaISssSbQsHbo496Vpy7OBxuvDvybpFuxyoxNXzzfcar1H0hg18O4Zn%252BwQ%252FRsCQ%252FOyNRX6d1GT0ljuBGrkVPSAPkh%252B3nx84yygfvAtOOkOSLSL4oJ3dOYtjD%252F4I%252FqIlfH16qMlzCAPyPAf0OsPrILXuJZOuz624DOIMmXIk2U%252Fy2opXnrct487aZr2W3qHrgrNGW4irAmAJM7lKy6KAdC5LmbaKlSmdd2xGS9UyqvKYgyQfnZcQY9akEwaBJId9TY6POzaXFSwkU1WryqorZ3RZiVkrVbGS3UpVExAbgagv8LaKOMLBYhA21IRRtkxplTJ6YgWnS16UWbVYfCdJcyvog7ZK2%252FP9NtsrCPmn06lJmy%252FHUyS4aAX%252BcUL%252FR5HfwGMsceIlm3XsgEfT%252Fv157%252FsRf25KNveE1%252Fl7%252BpvYwF8dH%252FaNM1r%252BSrbGuJedBxGmFMGPEA%252FSi%252FBvB0VWxBet0i5C%252BWhxAKk7DYrkm5vs33938xs%253D%26RelayState%3Dhttps%253A%252F%252Fesri.service-now.com%252Fsp%253Fid%253Dtake_survey%2526amp%253Binstance_id%253D2686790693fec7100dd8be7efaba10f6</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/la_jolla_sp_login_background.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/legacy_date_time_choices_processor.do?lang=en</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/GlideFlow.js?v=07-28-2026_2357</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/app.guided_tours/js_guided_tours_includes.jsx?v=07-28-2026_2357</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/bootstrap-datetimepicker.js?v=07-28-2026_2357</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/dist/sp_min.jsx?v=07-28-2026_2357</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/doctype/history_across_tabs.jsx?v=07-28-2026_2357</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/doctype/js_includes_doctype.jsx?v=07-28-2026_2357&amp;lp=Wed_Aug_19_20_21_28_PDT_2026&amp;c=37_1101</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/doctype/js_includes_last_doctype.jsx?v=07-28-2026_2357&amp;lp=Wed_Aug_19_20_21_28_PDT_2026&amp;c=37_1101</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/doctype/js_includes_legacy.jsx?v=07-28-2026_2357&amp;lp=Wed_Aug_19_20_21_28_PDT_2026&amp;c=37_1101</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/doctype/xperf_timing.jsx?v=07-28-2026_2357</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/doctype/z_last_include.jsx?v=07-28-2026_2357</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/heisenberg/heisenberg_all.jsx?v=07-28-2026_2357</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/icon-fonts/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/js_includes_customer.jsx?v=07-28-2026_2357&amp;lp=Wed_Aug_19_20_21_28_PDT_2026&amp;c=37_1101</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/js_includes_list_edit_doctype.jsx?v=07-28-2026_2357&amp;lp=Wed_Aug_19_20_21_28_PDT_2026&amp;c=37_1101</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/js_includes_sp_libs_min.jsx?v=07-28-2026_2357&amp;lp=Wed_Aug_19_20_21_28_PDT_2026&amp;c=37_1101</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/js_includes_ux_metrics.js?sysparm_substitute=false&amp;v=07-28-2026_2357&amp;lp=Wed_Aug_19_20_21_28_PDT_2026</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/polaris_theme_refresh_observer.jsx?v=07-28-2026_2357</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/thirdparty/dom_purify/purify.jsx?v=07-28-2026_2357&amp;sysparm_substitute=false</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/thirdparty/dompurify/purify.min.js?sysparm_substitute=false</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/transaction_scope_includes.jsx?v=07-28-2026_2357</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/scripts/ui_page_footer.jsx?v=07-28-2026_2357</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/sp?id=take_survey&amp;amp;instance_id=2686790693fec7100dd8be7efaba10f6</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/sp?id=take_survey&amp;amp;instance_id=2686790693fec7100dd8be7efaba10f6#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/styles/css_includes_$sp.css?v=9c03ca86c336c7101a075773e40131d3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/styles/css_includes_$sp_later.css?v=9c03ca86c336c7101a075773e40131d3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/styles/css_includes_doctype_polaris.cssx?v=07-28-2026_2357&amp;c=51034206c336c7101a075773e401315d&amp;theme=Polaris</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/styles/fonts/glyphicons-halflings-regular.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/styles/fonts/source-sans-pro/source-sans-pro-latin.css?v=9c03ca86c336c7101a075773e40131d3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/styles/fonts/source-sans-pro/source-sans-pro-v11-latin-600.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/styles/fonts/source-sans-pro/source-sans-pro-v11-latin-regular.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/styles/now_icons/now-icons.woff?1b83226fe70623e32efcda1aaf0a6462</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/styles/polarisberg/css_includes_polarisberg.cssx?v=07-28-2026_2357&amp;c=51034206c336c7101a075773e401315d&amp;theme=Polaris</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/styles/retina_icons/retina_icons.css?v=07-28-2026_2357</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/styles/retina_icons/retina_icons.woff?48738ebcb15c33e079d559483fe7e2aa</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/styles/scss/sp-bootstrap-rem.scss?portal_id=81b75d3147032100ba13a5554ee4902b&amp;theme_id=281507c44317d210ca4c1f425db8f2fd&amp;v=9c03ca86c336c7101a075773e40131d3&amp;uxf_theme_id=fad87d2ca304121029a4d1aed31e610f&amp;uxf_theme_variant_id=null&amp;is_rtl=false&amp;sp_variant_m2m_id=</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/uxasset/externals/@devsnc/sn-ui-logger/index.jsdbx?sysparm_use_cache_buster=true&amp;uxpcb=1787258705433</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/uxasset/externals/@servicenow/now-icon/icons/magnifyingGlass.jsdbx?sysparm_use_cache_buster=true&amp;uxpcb=1787258705433</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/uxasset/externals/@servicenow/ui-analytics-bundle/bundled-assets.jsdbx?sysparm_use_cache_buster=true&amp;uxpcb=1787258705433</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/uxasset/externals/@servicenow/ui-mega/index.jsdbx?sysparm_use_cache_buster=true&amp;uxpcb=1787258705433</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/uxasset/externals/amb-client-js/index.jsdbx?sysparm_use_cache_buster=true&amp;uxpcb=1787258705433</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/uxta/79aa856b771220104fdc5ed9991061a5.assetx</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/xmlhttp.do</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js-cdn.dynatrace.com/jstag/16294a69b33/bf33006wli/22c3ff908c66b5a9_complete.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://js-cdn.dynatrace.com/jstag/16294a69b33/bf33006wli/3169fcb51c3623e1_complete.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://login.live.com/Me.htm?v=3</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/aee6e3c9-711e-4c7c-bd27-04f2307db20d/saml2</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/aee6e3c9-711e-4c7c-bd27-04f2307db20d/saml2?SAMLRequest=lVJLj9MwEP4rke9JHPeR1GoqlVaISssSbQsHbo496Vpy7OBxuvDvybpFuxyoxNXzzfcar1H0hg18O4Zn%2BwQ%2FRsCQ%2FOyNRX6d1GT0ljuBGrkVPSAPkh%2B3nx84yygfvAtOOkOSLSL4oJ3dOYtjD%2F4I%2FqIlfH16qMlzCAPyPAf0OsPrILXuJZOuz624DOIMmXIk2U%2Fy2opXnrct487aZr2W3qHrgrNGW4irAmAJM7lKy6KAdC5LmbaKlSmdd2xGS9UyqvKYgyQfnZcQY9akEwaBJId9TY6POzaXFSwkU1WryqorZ3RZiVkrVbGS3UpVExAbgagv8LaKOMLBYhA21IRRtkxplTJ6YgWnS16UWbVYfCdJcyvog7ZK2%2FP9NtsrCPmn06lJmy%2FHUyS4aAX%2BcUL%2FR5HfwGMsceIlm3XsgEfT%2Fv157%2FsRf25KNveE1%2Fl7%2BpvYwF8dH%2FaNM1r%2BSrbGuJedBxGmFMGPEA%2FSi%2FBvB0VWxBet0i5C%2BWhxAKk7DYrkm5vs33938xs%3D&amp;RelayState=https%3A%2F%2Fesri.service-now.com%2Fsp%3Fid%3Dtake_survey%26amp%3Binstance_id%3D2686790693fec7100dd8be7efaba10f6</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/aee6e3c9-711e-4c7c-bd27-04f2307db20d/saml2?SAMLRequest=lVJLj9MwEP4rke9JHPeR1GoqlVaISssSbQsHbo496Vpy7OBxuvDvybpFuxyoxNXzzfcar1H0hg18O4Zn%2BwQ%2FRsCQ%2FOyNRX6d1GT0ljuBGrkVPSAPkh%2B3nx84yygfvAtOOkOSLSL4oJ3dOYtjD%2F4I%2FqIlfH16qMlzCAPyPAf0OsPrILXuJZOuz624DOIMmXIk2U%2Fy2opXnrct487aZr2W3qHrgrNGW4irAmAJM7lKy6KAdC5LmbaKlSmdd2xGS9UyqvKYgyQfnZcQY9akEwaBJId9TY6POzaXFSwkU1WryqorZ3RZiVkrVbGS3UpVExAbgagv8LaKOMLBYhA21IRRtkxplTJ6YgWnS16UWbVYfCdJcyvog7ZK2%2FP9NtsrCPmn06lJmy%2FHUyS4aAX%2BcUL%2FR5HfwGMsceIlm3XsgEfT%2Fv157%2FsRf25KNveE1%2Fl7%2BpvYwF8dH%2FaNM1r%2BSrbGuJedBxGmFMGPEA%2FSi%2FBvB0VWxBet0i5C%2BWhxAKk7DYrkm5vs33938xs%3D&amp;RelayState=https%3A%2F%2Fesri.service-now.com%2Fsp%3Fid%3Dtake_survey%26amp%3Binstance_id%3D2686790693fec7100dd8be7efaba10f6&amp;sso_reload=true</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/common/instrumentation/dssostatus</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/favicon.ico</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://privacy.microsoft.com/en-US/privacystatement</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.microsoft.com/en-US/servicesagreement/</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://esri.service-now.com/sp?id=take_survey&amp;amp;instance_id=2686790693fec7100dd8be7efaba10f6&amp;sso_reload=true</url>
              <origin>URL_RENDER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://login.microsoftonline.com/aee6e3c9-711e-4c7c-bd27-04f2307db20d/saml2?SAMLRequest=lVJLj9MwEP4rke9JHPeR1GoqlVaISssSbQsHbo496Vpy7OBxuvDvybpFuxyoxNXzzfcar1H0hg18O4Zn%2BwQ%2FRsCQ%2FOyNRX6d1GT0ljuBGrkVPSAPkh%2B3nx84yygfvAtOOkOSLSL4oJ3dOYtjD%2F4I%2FqIlfH16qMlzCAPyPAf0OsPrILXuJZOuz624DOIMmXIk2U%2Fy2opXnrct487aZr2W3qHrgrNGW4irAmAJM7lKy6KAdC5LmbaKlSmdd2xGS9UyqvKYgyQfnZcQY9akEwaBJId9TY6POzaXFSwkU1WryqorZ3RZiVkrVbGS3UpVExAbgagv8LaKOMLBYhA21IRRtkxplTJ6YgWnS16UWbVYfCdJcyvog7ZK2%2FP9NtsrCPmn06lJmy%2FHUyS4aAX%2BcUL%2FR5HfwGMsceIlm3XsgEfT%2Fv157%2FsRf25KNveE1%2Fl7%2BpvYwF8dH%2FaNM1r%2BSrbGuJedBxGmFMGPEA%2FSi%2FBvB0VWxBet0i5C%2BWhxAKk7DYrkm5vs33938xs%3D&amp;RelayState=https%3A%2F%2Fesri.service-now.com%2Fsp%3Fid%3Dtake_survey%26amp%3Binstance_id%3D2686790693fec7100dd8be7efaba10f6</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://esri.service-now.com/sp?id=take_survey&amp;amp;instance_id=2686790693fec7100dd8be7efaba10f6</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>https://api-appsee.service-now.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
          </urls>
          <domains>
            <value>
              <url>aadcdn.msauth.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>aadcdn.msauthimages.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>aadcdn.msftauth.net</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>autologon.microsoftazuread-sso.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>esri.service-now.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>js-cdn.dynatrace.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>login.live.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>login.microsoftonline.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>privacy.microsoft.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>www.microsoft.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>api-appsee.service-now.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
          </domains>
          <ips>
            <value>
              <ip>149.96.120.9</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>13.107.246.45</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>149.96.46.61</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>2.16.241.224</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>20.190.159.129</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>20.190.159.130</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>40.126.31.129</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>52.222.236.22</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>63fc1b51a37019eca6fd8c986f2e2168afc9cf0f22a33f85666969fa79c3434e</SHA-256>
              <SHA-1>495863cfe508c6b05fb5289dbbb00e5292ab3c2b</SHA-1>
              <MD5>13baa62a12c12a987c56d59d6ac37d7f</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/plain</file_type>
              <verdict>UNKNOWN</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://esri.service-now.com/sp?id=take_survey&amp;amp;instance_id=2686790693fec7100dd8be7efaba10f6</name>
        <report_id>4d9a8beb-c84d-4d79-9a7c-bc178127665c</report_id>
        <tags>
          <value>html</value>
          <value>txt</value>
          <value>aidetect</value>
          <value>phishing</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>20c85a3f9fc1cee76a1545c4464dc144407e6754562f8d5b1c0c2164d6f04919</id>
    <title>Analysis Report for 20c85a3f9fc1cee76a1545c4464dc144407e6754562f8d5b1c0c2164d6f04919</title>
    <updated>2026-08-20T21:04:22Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876bdef2677ae4d366d35d</_id>
        <file_type>text/csv</file_type>
        <flow_id>6a876bd21d88974f46c4047c</flow_id>
        <hash>20c85a3f9fc1cee76a1545c4464dc144407e6754562f8d5b1c0c2164d6f04919</hash>
        <iocs/>
        <name>messaging-usage-2026-07-07-2026-08-06.csv</name>
        <report_id>dc5d8d15-f163-48fb-a212-40a0857fee2b</report_id>
        <tags>
          <value>csv</value>
        </tags>
        <verdict>NO_THREAT</verdict>
      </details>
    </content>
  </entry>
  <entry>
    <id>cecb5ffde3af503769ed5a7ba9babe7489e7e0f2346946e50f2a1b88dee09e8e</id>
    <title>Analysis Report for cecb5ffde3af503769ed5a7ba9babe7489e7e0f2346946e50f2a1b88dee09e8e</title>
    <updated>2026-08-20T21:02:52Z</updated>
    <content type="application/xml">
      <details>
        <_id>6a876c3a49c2438a47b72910</_id>
        <file_type>text/html</file_type>
        <flow_id>6a876b791d88974f46c40424</flow_id>
        <hash>cecb5ffde3af503769ed5a7ba9babe7489e7e0f2346946e50f2a1b88dee09e8e</hash>
        <iocs>
          <urls>
            <value>
              <url>https://cioviews.com/</url>
              <origin>INPUT_FILE</origin>
            </value>
            <value>
              <url>2.9.1.2</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>3.8.14.2</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cioviews.com/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/&amp;format=xml</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://abris-dg.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cioviews.com/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cioviews.com/about-us/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cioviews.com/advertisements/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cioviews.com/business-women-2026/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cioviews.com/category/african-media-agency/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cioviews.com/category/blogs/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cioviews.com/category/industry/</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <url>https://cioviews.com/category/press-release/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/comments/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/education</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/home/feed/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/magazines/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/order-magazine-print-copies/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/subscribe/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=4.2.2</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=4.2.2</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=4.2.2</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=4.2.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=4.2.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=4.2.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/lib/font-awesome/js/v4-shims.min.js?ver=4.2.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/lib/swiper/v8/swiper.min.js?ver=8.4.5</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-elements/assets/js/jet-elements.min.js</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-elements/assets/js/jet-elements.min.js?ver=2.9.1.2</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-elements/assets/js/lib/tweenjs/tweenjs.min.js?ver=2.0.2</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-engine/assets/css/frontend.css</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-engine/assets/css/frontend.css?ver=3.8.14.2</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-tricks/assets/js/jet-tricks-frontend.js?ver=2.0.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-tricks/assets/js/lib/tippy/popperjs.js?ver=2.11.8</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-tricks/assets/js/lib/tippy/tippy-bundle.js?ver=6.3.7</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-tricks/assets/js/lib/ts-particles/1.18.11/tsparticles.min.js?ver=1.18.11</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-tricks/assets/lib/jet-plugins/jet-plugins.js?ver=1.1.0</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-cloud-library/assets/css/tdb_main.css?ver=d578089f160957352b9b4ca6d880fd8f</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-cloud-library/assets/js/js_files_for_front.min.js?ver=d578089f160957352b9b4ca6d880fd8f</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-cloud-library/assets/js/tdbMenu.js?ver=d578089f160957352b9b4ca6d880fd8f</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-cloud-library/assets/js/tdbSearch.js?ver=d578089f160957352b9b4ca6d880fd8f</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/assets/css/td_legacy_main.css?ver=492e3cf54bd42df3b24a3de8e2307cafx</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tagdiv_theme.min.js?ver=12.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdAjaxSearch.js?ver=12.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdLoadingBox.js?ver=12.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdMenu.js?ver=12.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdModalPostImages.js?ver=12.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdPostImages.js?ver=12.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdSmartSidebar.js?ver=12.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdSocialSharing.js?ver=12.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdToTop.js?ver=12.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdTrendingNow.js?ver=12.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/td-multi-purpose/style.css?ver=492e3cf54bd42df3b24a3de8e2307cafx</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/themes/Newspaper/style.css?ver=12.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2026/05/cropped-CIOViewsFavicon-180x180.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2026/05/cropped-CIOViewsFavicon-192x192.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2026/05/cropped-CIOViewsFavicon-32x32.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2026/05/favicon.png</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-includes/js/comment-reply.min.js?ver=6.8.8</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-includes/js/dist/hooks.min.js?ver=4d63a3d491d11ffd8ac6</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.3</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-json/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-json/oembed/1.0/embed</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fcioviews.com%2F</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fcioviews.com%2F&amp;format=xml</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-json/wp/v2/pages/55769</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/xmlrpc.php</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://cioviews.com/xmlrpc.php?rsd</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://dartit.ai/?utm_source=magazine&amp;utm_medium=banner-green&amp;utm_campaign=cio-view</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Montserrat%3A400%2C300%2C700%7COpen+Sans%3A400%2C600%2C700%2C300%7CRoboto%3A400%2C600%2C700%2C300%7CRoboto%3A900%2C400%7CMontserrat%3A500%2C400&amp;display=swap&amp;ver=12.7.1</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Roboto+Slab:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=auto</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Roboto:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=auto</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/cioviews/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.googletagmanager.com/ns.html?id=GTM-K3N92N9</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://www.instagram.com/cioviews.magazine/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/cioviews</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://www.pinterest.com/cioviews/</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://x.com/CIOviews</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>https://abris-dg.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/#</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/10-platforms-to-find-your-business-market-value-in-2024/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/20-inspiring-warren-buffett-quotes-to-inspire-you/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/5-best-digital-marketing-strategies-to-follow/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/5-factors-to-consider-when-building-a-digital-workspace/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/5-key-challenges-in-the-oil-and-gas-industry/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/5-major-traits-of-professional-it-services-company/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/about-us/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/advertisements/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/africas-most-influential-leaders-in-banking-finance-2026-aug-20/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/asia-pay-embracing-change-and-digital-innovation/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/barbara-treadwell-redefining-financial-planning-by-merging-mind-heart-and-service/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/ben-chodor-harnessing-ai-and-empowering-people-to-achieve-customer-intimacy/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/bernard-motshidisi-mvami-building-stronger-institutions-through-leadership-trust-and-purpose/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/best-10-amazing-gifts-under-50-that-everyone-will-love/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/big-data-revolutionizing-the-healthcare-industry/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/business-women-2026/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/category/african-media-agency/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/category/blogs/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/category/industry/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/category/press-release/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/christopher-risher-the-problem-solver-making-technology-more-human/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/contact-us/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/craigslist-a-success-story-with-many-lessons-for-todays-entrepreneurs/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/daria-dubinina-advancing-the-fintech-industry-ahead-with-crassula/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/disclaimer/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/dr-georges-ale-revolutionizing-africas-infrastructure-project-management-3/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/dr-papa-benin-a-visionary-leader-in-oil-gas-project-management-engineering-operations-in-ghana-west-africa/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/education</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/elaine-king-empowering-latinas-through-financial-well-being-and-beyond/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/empowering-africa-esther-dassanous-journey-to-transforming-lives/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/faizan-ahmed-decoding-a-new-era-of-finance-with-trust-and-tech/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/flipkart-to-deploy-evs-instead-of-its-delivery-vans-by-2020/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/from-entrepreneurship-to-global-impact-aisha-washingtons-inspiring-chronicle-at-hewlett-packard-enterprise/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/giovana-monte-guarding-the-future-of-connectivity-with-groundbreaking-grit/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/harley-davidson-will-approach-china-to-make-smaller-bikes/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/hepsen-uzcan-a-driving-force-for-inspiration-and-innovation/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/how-cub-terminals-shadow-mirkhaef-is-turning-supply-chain-pressure-points-into-inland-opportunities/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/how-human-centered-marketing-is-revolutionizing-b2b-brands/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/how-to-choose-a-good-disability-claim-company-and-avoiding-bad-actors-2/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/indeed-vs-ziprecruiter-vs-linkedin-which-is-right-for-you/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/iot-in-home-automation/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/jason-bare-building-on-family-legacy-to-propel-bare-internationals-tremendous-growth-and-expansion/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/jens-mittendorf-a-journey-from-navy-diver-to-medical-systems-leader/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/kenneth-dolin-on-building-a-personal-brand-that-thrives-in-a-hybrid-world/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/leon-brandre-an-influential-leader-shaping-africas-digital-future-with-resilience-and-innovation/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/leticia-ncho-traore-renowned-entrepreneur-with-expertise-in-strategic-operational-management-2/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/linkedin-a-virtual-description-of-your-professional-details/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/magazines/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/maria-moore-empowering-leadership-in-the-financial-industry/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/maria-victoria-arrastua-driving-people-centered-digital-transformation-through-empathetic-collaborative-leadership/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/matthew-smith-building-sustainable-banks-through-alignment-accountability-and-execution/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/michelle-beyo-innovative-payment-and-digital-services/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/minjon-tholen-integrating-dei-values-into-the-organizational-culture-both-internally-and-externally/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/mohit-gupta-on-leading-with-purpose-agility-and-impact-in-global-finance/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/naisha-bradley-determined-to-create-a-more-equitable-future-for-all/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/nanda-krishnan-a-resourceful-supply-chain-leader-driving-change-for-sustainability/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/order-magazine-print-copies/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/pioneering-excellence-ken-lu-and-the-evolution-of-winmate-inc/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/privacy/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/proserveit-launches-a-new-website-designed-to-make-technology-feel-more-human/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/renewable-energy-creates-history-in-us/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/russ-ruffino-on-why-most-high-ticket-coaching-programs-fail-their-clients-before-they-start/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/subscribe/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/tech-investing-with-purpose-how-black-dragon-capital-aligns-profit-with-social-impact/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/terms-and-conditions/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/the-10-most-impactful-leaders-making-a-difference-2026-aug-14/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/the-10-most-impactful-people-in-legal-services-2026-aug-19/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/the-10-most-influential-women-leaders-shaping-the-future-of-business-2026-aug-11/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/the-10-most-innovative-ceos-in-financial-services-2026-aug-12/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/the-10-visionary-entrepreneurs-transforming-business-through-ai-2026-aug-19/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/the-future-of-education-one-small-shift-for-education-one-giant-leap-for-humanity/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/the-history-of-artificial-intelligence/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/the-modern-ceo-playbook-balancing-vision-vulnerability-velocity/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/the-next-level-cloud-computing-trends-in-2020/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/the-queen-of-collaboration-amanda-fishburn-is-changing-the-game-in-events/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/top-3-big-data-myths-and-truths/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/top-4-changes-in-car-designs/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/top-companies-in-utility-and-energy-analytics-market/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/untangling-the-gridlock-how-ppb-coo-amanda-bannon-clears-the-path-for-private-wealth/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/unwana-utuk-driving-success-through-commercial-and-legal-excellence/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/vfx-and-gamifications-one-of-the-most-deceiving-illusions/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/viable-career-options-in-cybersecurity/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/volkswagen-to-start-production-plant-in-turkey/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wendy-gondi-leading-the-charge-towards-excellence-and-innovation/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/why-should-you-choose-energy-efficient-appliances/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/women-redefining-the-entrepreneurial-industry/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor-pro/assets/css/widget-carousel-module-base.min.css?ver=4.2.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor-pro/assets/css/widget-media-carousel.min.css?ver=4.2.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=4.2.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=4.2.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor-pro/assets/js/media-carousel.87c2cf115553a2c4f709.bundle.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=4.2.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/css/conditionals/e-swiper.min.css?ver=4.2.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=4.2.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/css/widget-heading.min.css?ver=4.2.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/css/widget-image-carousel.min.css?ver=4.2.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/css/widget-image.min.css?ver=4.2.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=4.2.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=4.2.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/js/image-carousel.6167d20b95b33386757b.bundle.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/js/section-frontend-handlers.d85ab872da118940910d.bundle.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/js/shared-frontend-handlers.03caa53373b56d3bab67.bundle.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=4.2.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/lib/animations/styles/fadeIn.min.css?ver=4.2.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=5.53.0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff2?5.53.0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=4.2.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/v4-shims.min.css?ver=4.2.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/lib/font-awesome/js/v4-shims.min.js?ver=4.2.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/lib/swiper/v8/css/swiper.min.css?ver=8.4.5</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/elementor/assets/lib/swiper/v8/swiper.min.js?ver=8.4.5</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-elements/assets/css/jet-elements.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-elements/assets/css/jet-elements.css?ver=2.9.1.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-elements/assets/js/jet-elements.min.js</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-elements/assets/js/jet-elements.min.js?ver=2.9.1.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-elements/assets/js/lib/tweenjs/tweenjs.min.js?ver=2.0.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-engine/assets/css/frontend.css</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-engine/assets/css/frontend.css?ver=3.8.14.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-tricks/assets/css/jet-tricks-frontend.css?ver=2.0.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-tricks/assets/js/jet-tricks-frontend.js?ver=2.0.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-tricks/assets/js/lib/tippy/popperjs.js?ver=2.11.8</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-tricks/assets/js/lib/tippy/tippy-bundle.js?ver=6.3.7</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-tricks/assets/js/lib/ts-particles/1.18.11/tsparticles.min.js?ver=1.18.11</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/jet-tricks/assets/lib/jet-plugins/jet-plugins.js?ver=1.1.0</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-cloud-library/assets/css/tdb_main.css?ver=d578089f160957352b9b4ca6d880fd8f</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-cloud-library/assets/js/js_files_for_front.min.js?ver=d578089f160957352b9b4ca6d880fd8f</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-cloud-library/assets/js/tdbMenu.js?ver=d578089f160957352b9b4ca6d880fd8f</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-cloud-library/assets/js/tdbSearch.js?ver=d578089f160957352b9b4ca6d880fd8f</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/assets/css/td_legacy_main.css?ver=492e3cf54bd42df3b24a3de8e2307cafx</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tagdiv_theme.min.js?ver=12.7.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdAjaxSearch.js?ver=12.7.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdLoadingBox.js?ver=12.7.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdMenu.js?ver=12.7.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdModalPostImages.js?ver=12.7.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdPostImages.js?ver=12.7.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdSmartSidebar.js?ver=12.7.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdSocialSharing.js?ver=12.7.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdToTop.js?ver=12.7.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdTrendingNow.js?ver=12.7.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/plugins/td-composer/td-multi-purpose/style.css?ver=492e3cf54bd42df3b24a3de8e2307cafx</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/themes/Newspaper/images/icons/newspaper.woff?24</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/themes/Newspaper/style.css?ver=12.7.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2019/03/post_placeholder_image-min.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2019/04/Main-logo.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2019/05/mob-logo.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2023/10/2.-Elaine-King-696x466.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2024/06/2.-Maria-Moore.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2025/09/2.-Mohit-Gupta.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2025/09/CIO-Views-Logo-White.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2025/09/Digital-ad-1.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2025/09/Digital-ad-2.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2025/09/Horizontal_dark.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2025/09/Square_dark.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2025/09/mobile-bg.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2026/05/cropped-CIOViewsFavicon-32x32.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2026/05/favicon.png</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2026/08/1.-Bernard-Motshidisi-Mvami.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2026/08/Barbara-Treadwell-Cover-Page-2026.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2026/08/Bernard-Motshidisi-Mvami-Cover-Page-2026-230x300.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2026/08/Bernard-Motshidisi-Mvami-Cover-Page-2026.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2026/08/Chris-Risher-Cover-Page-2026.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2026/08/Giovana-Monte-Cover-Page-2026.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2026/08/Maria-Victoria-Arrastua-Cover-Page-2026-1.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-content/uploads/2026/08/Matthew-Smith-Cover-Page-2026.jpg</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-includes/js/comment-reply.min.js?ver=6.8.8</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-includes/js/dist/hooks.min.js?ver=4d63a3d491d11ffd8ac6</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.3</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/wp-includes/js/wp-emoji-release.min.js?ver=6.8.8</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://cioviews.com/youtube-is-trending-as-source-of-remittance/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://dartit.ai/?utm_source=magazine&amp;utm_medium=banner-green&amp;utm_campaign=cio-view</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Montserrat%3A400%2C300%2C700%7COpen+Sans%3A400%2C600%2C700%2C300%7CRoboto%3A400%2C600%2C700%2C300%7CRoboto%3A900%2C400%7CMontserrat%3A500%2C400&amp;display=swap&amp;ver=12.7.1</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Roboto+Slab:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=auto</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.googleapis.com/css?family=Roboto:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&amp;display=auto</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/roboto/v51/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkBnka.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.facebook.com/cioviews/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.instagram.com/cioviews.magazine/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.linkedin.com/company/cioviews</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://www.pinterest.com/cioviews/</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>https://x.com/CIOviews</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>mailto:info@cioviews.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>2.9.1.2</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>3.8.14.2</url>
              <origin>URL_RENDER</origin>
            </value>
          </urls>
          <domains>
            <value>
              <url>abris-dg.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>cioviews.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <url>dartit.ai</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>googletagmanager.com</url>
              <origin>EXTERNAL_PARSER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.instagram.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>www.pinterest.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>x.com</url>
              <origin>EXTERNAL_PARSER</origin>
            </value>
            <value>
              <url>abris-dg.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>cioviews.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>dartit.ai</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>fonts.googleapis.com</url>
              <origin>URL_RENDER</origin>
              <verdict>whitelisted</verdict>
            </value>
            <value>
              <url>fonts.gstatic.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.facebook.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.instagram.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.linkedin.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>www.pinterest.com</url>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <url>x.com</url>
              <origin>URL_RENDER</origin>
            </value>
          </domains>
          <emails>
            <value>
              <email>info@cioviews.com</email>
              <origin>INPUT_FILE</origin>
            </value>
          </emails>
          <ips>
            <value>
              <ip>142.251.127.97</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>185.104.45.82</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>162.215.223.101</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>172.67.182.71</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>157.240.253.174</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>162.159.140.229</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>57.144.244.1</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>104.18.41.41</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>72.246.31.136</ip>
              <origin>DOMAIN_RESOLVE</origin>
              <verdict>UNKNOWN</verdict>
            </value>
            <value>
              <ip>142.251.14.94</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>142.251.20.95</ip>
              <origin>URL_RENDER</origin>
            </value>
            <value>
              <ip>162.215.223.101</ip>
              <origin>URL_RENDER</origin>
            </value>
          </ips>
          <files>
            <value>
              <SHA-256>8f02825ea3eaba6de839d2f950d0c2f8242dd90b944f5cf6ad48b93d0018bcac</SHA-256>
              <SHA-1>c3018d0d420219b941c5d60c8e6aa246f269b8e4</SHA-1>
              <MD5>0d24fc2b47d784a1e67977caaf75dec8</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>9e32994a934c96b021fb673bb9262a8d5683acaea4840c7c2fea66f1f487405a</SHA-256>
              <SHA-1>6070b70a3ce18b916d278510c382c688670119cd</SHA-1>
              <MD5>c308fec1e0c99b6d064a41b8d734fed1</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>ee7253eda18b23569d7c5d5464416314a06635cc2855d546d39d10205c9ad323</SHA-256>
              <SHA-1>bc33351a0895facd473e23d8f3fb56109593bb0b</SHA-1>
              <MD5>1f1fdac6b5798810536a19fbdfec4f56</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>8e4ada3f3ddb5089851cb2634054bad451e1c69115155de639dd1634d38b86e5</SHA-256>
              <SHA-1>1b7f54f544be8ee70be8b122d5c94912b9c2ded9</SHA-1>
              <MD5>4e72347815512427071890983335c6e9</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>2d42105689e0480ca126d5785e78268d1d9a1697485b6ac0dd6959a3e19aa0e9</SHA-256>
              <SHA-1>bca3bef94016744d24352c72336ffd40e6d7d694</SHA-1>
              <MD5>07c39f5454837515d7e50316d2cf4cb6</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>e8fa9c358f183b7f23bf0bdd6eb21134610f5c3c2673115748191cfed03a2adf</SHA-256>
              <SHA-1>b6aabf498eb9feb59456283f8b3aca00cad1173f</SHA-1>
              <MD5>1e3ec81ac13cb6d444be05d3fb61dd05</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
            <value>
              <SHA-256>0837cac15233e7bfb957c7eb0136ceaf18fd2c673d13c1b20f385ab990963e5b</SHA-256>
              <SHA-1>96662cf27906a9f1ec20fb6a895ab23e7e6c0a4f</SHA-1>
              <MD5>4de54d8db5fcd161a40786443b4ec057</MD5>
              <origin>DOWNLOADED_FILE</origin>
              <file_type>text/html</file_type>
              <verdict>NO_THREAT</verdict>
            </value>
          </files>
        </iocs>
        <name>hxxps://cioviews.com/</name>
        <report_id>b98a587b-1c03-46cd-8dcc-ec2bebecd2b5</report_id>
        <tags>
          <value>html</value>
          <value>base64</value>
          <value>obfuscated</value>
        </tags>
        <verdict>SUSPICIOUS</verdict>
      </details>
    </content>
  </entry>
</feed>
