Detected presence of files that collect and exfiltrate user information. (x1)

Detected presence of plaintext credentials within network protocol strings. (x3)

Detected presence of files containing URLs that use non-standard ports. (x5)

Detected presence of software components that can access user identity information. (x2)

Detected presence of files containing bidirectional Unicode control characters. (x1)