Detected presence of files containing references to TOR or hidden service URLs. (x2)

Detected presence of files containing URLs that link to raw files on GitHub. (x1)

Detected presence of files containing URLs that reside in regions with US export restrictions. (x2)

Detected presence of files containing URLs that reside in regions with EU export restrictions. (x3)

Detected presence of files with behaviors commonly used by malicious software. (x1)

Detected presence of files containing URLs that use trusted domains as subdomains. (x1)

Detected presence of files containing URLs that use suspicious top-level domains. (x4)

Detected presence of files containing URLs with suspicious path components. (x1)

Detected presence of files containing URLs that use non-standard ports. (x3)

Detected presence of files containing URLs that link to Dropbox download pages. (x1)