{
    "segments": [
        {
            "id": 1,
            "seek": 2832,
            "start": 1.21,
            "end": 4.05,
            "text": " Hello and welcome to my presentation with the title",
            "tokens": [
                50414,
                2425,
                293,
                2928,
                281,
                452,
                5860,
                365,
                264,
                4876,
                50564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2780123954420691,
            "compression_ratio": 1.6867924528301887,
            "no_speech_prob": 0.399169921875,
            "words": [
                {
                    "start": 1.21,
                    "end": 1.53,
                    "word": " Hello",
                    "probability": 0.619140625
                },
                {
                    "start": 1.53,
                    "end": 1.93,
                    "word": " and",
                    "probability": 0.76904296875
                },
                {
                    "start": 1.93,
                    "end": 2.21,
                    "word": " welcome",
                    "probability": 0.75439453125
                },
                {
                    "start": 2.21,
                    "end": 2.59,
                    "word": " to",
                    "probability": 0.8974609375
                },
                {
                    "start": 2.59,
                    "end": 2.79,
                    "word": " my",
                    "probability": 0.9013671875
                },
                {
                    "start": 2.79,
                    "end": 3.35,
                    "word": " presentation",
                    "probability": 0.798828125
                },
                {
                    "start": 3.35,
                    "end": 3.57,
                    "word": " with",
                    "probability": 0.55859375
                },
                {
                    "start": 3.57,
                    "end": 3.69,
                    "word": " the",
                    "probability": 0.7900390625
                },
                {
                    "start": 3.69,
                    "end": 4.05,
                    "word": " title",
                    "probability": 0.9033203125
                }
            ]
        },
        {
            "id": 2,
            "seek": 2832,
            "start": 4.05,
            "end": 6.71,
            "text": " Hunting for Blue Mockingbird Coin Miners.",
            "tokens": [
                50564,
                44793,
                337,
                8510,
                376,
                31730,
                18080,
                39054,
                2829,
                433,
                13,
                50664
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2780123954420691,
            "compression_ratio": 1.6867924528301887,
            "no_speech_prob": 0.399169921875,
            "words": [
                {
                    "start": 4.05,
                    "end": 4.51,
                    "word": " Hunting",
                    "probability": 0.1700439453125
                },
                {
                    "start": 4.51,
                    "end": 4.87,
                    "word": " for",
                    "probability": 0.8642578125
                },
                {
                    "start": 4.87,
                    "end": 5.07,
                    "word": " Blue",
                    "probability": 0.70068359375
                },
                {
                    "start": 5.07,
                    "end": 5.55,
                    "word": " Mockingbird",
                    "probability": 0.9025065104166666
                },
                {
                    "start": 5.55,
                    "end": 5.81,
                    "word": " Coin",
                    "probability": 0.689453125
                },
                {
                    "start": 5.81,
                    "end": 6.23,
                    "word": " Miners",
                    "probability": 0.916259765625
                },
                {
                    "start": 6.23,
                    "end": 6.71,
                    "word": ".",
                    "probability": 0.77001953125
                }
            ]
        },
        {
            "id": 3,
            "seek": 2832,
            "start": 6.71,
            "end": 10.23,
            "text": " I am Vladislav Bačov and I would like to spend the next 20 or 25 minutes",
            "tokens": [
                50664,
                286,
                669,
                21958,
                5788,
                706,
                6777,
                10236,
                5179,
                293,
                286,
                576,
                411,
                281,
                3496,
                264,
                958,
                945,
                420,
                3552,
                2077,
                50864
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2780123954420691,
            "compression_ratio": 1.6867924528301887,
            "no_speech_prob": 0.399169921875,
            "words": [
                {
                    "start": 6.71,
                    "end": 6.83,
                    "word": " I",
                    "probability": 0.9814453125
                },
                {
                    "start": 6.83,
                    "end": 6.95,
                    "word": " am",
                    "probability": 0.81103515625
                },
                {
                    "start": 6.95,
                    "end": 7.35,
                    "word": " Vladislav",
                    "probability": 0.7950846354166666
                },
                {
                    "start": 7.35,
                    "end": 7.63,
                    "word": " Bačov",
                    "probability": 0.469970703125
                },
                {
                    "start": 7.63,
                    "end": 7.75,
                    "word": " and",
                    "probability": 0.82568359375
                },
                {
                    "start": 7.75,
                    "end": 7.89,
                    "word": " I",
                    "probability": 0.9736328125
                },
                {
                    "start": 7.89,
                    "end": 8.01,
                    "word": " would",
                    "probability": 0.8408203125
                },
                {
                    "start": 8.01,
                    "end": 8.21,
                    "word": " like",
                    "probability": 0.87158203125
                },
                {
                    "start": 8.21,
                    "end": 8.35,
                    "word": " to",
                    "probability": 0.9013671875
                },
                {
                    "start": 8.35,
                    "end": 8.61,
                    "word": " spend",
                    "probability": 0.82177734375
                },
                {
                    "start": 8.61,
                    "end": 8.75,
                    "word": " the",
                    "probability": 0.80078125
                },
                {
                    "start": 8.75,
                    "end": 8.89,
                    "word": " next",
                    "probability": 0.85009765625
                },
                {
                    "start": 8.89,
                    "end": 9.27,
                    "word": " 20",
                    "probability": 0.8359375
                },
                {
                    "start": 9.27,
                    "end": 9.41,
                    "word": " or",
                    "probability": 0.857421875
                },
                {
                    "start": 9.41,
                    "end": 9.77,
                    "word": " 25",
                    "probability": 0.90869140625
                },
                {
                    "start": 9.77,
                    "end": 10.23,
                    "word": " minutes",
                    "probability": 0.8583984375
                }
            ]
        },
        {
            "id": 4,
            "seek": 2832,
            "start": 10.23,
            "end": 13.09,
            "text": " with talking about incident response and investigation",
            "tokens": [
                50864,
                365,
                1417,
                466,
                9348,
                4134,
                293,
                9627,
                51014
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2780123954420691,
            "compression_ratio": 1.6867924528301887,
            "no_speech_prob": 0.399169921875,
            "words": [
                {
                    "start": 10.23,
                    "end": 10.77,
                    "word": " with",
                    "probability": 0.74072265625
                },
                {
                    "start": 10.77,
                    "end": 11.09,
                    "word": " talking",
                    "probability": 0.7734375
                },
                {
                    "start": 11.09,
                    "end": 11.55,
                    "word": " about",
                    "probability": 0.8232421875
                },
                {
                    "start": 11.55,
                    "end": 11.85,
                    "word": " incident",
                    "probability": 0.5634765625
                },
                {
                    "start": 11.85,
                    "end": 12.35,
                    "word": " response",
                    "probability": 0.86279296875
                },
                {
                    "start": 12.35,
                    "end": 12.65,
                    "word": " and",
                    "probability": 0.8876953125
                },
                {
                    "start": 12.65,
                    "end": 13.09,
                    "word": " investigation",
                    "probability": 0.65380859375
                }
            ]
        },
        {
            "id": 5,
            "seek": 2832,
            "start": 13.09,
            "end": 17.35,
            "text": " of the recent incidents attributed to the relatively new trade actor",
            "tokens": [
                51014,
                295,
                264,
                5162,
                21139,
                30976,
                281,
                264,
                7226,
                777,
                4923,
                8747,
                51214
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2780123954420691,
            "compression_ratio": 1.6867924528301887,
            "no_speech_prob": 0.399169921875,
            "words": [
                {
                    "start": 13.09,
                    "end": 13.63,
                    "word": " of",
                    "probability": 0.88134765625
                },
                {
                    "start": 13.63,
                    "end": 13.77,
                    "word": " the",
                    "probability": 0.701171875
                },
                {
                    "start": 13.77,
                    "end": 13.99,
                    "word": " recent",
                    "probability": 0.7685546875
                },
                {
                    "start": 13.99,
                    "end": 14.57,
                    "word": " incidents",
                    "probability": 0.79296875
                },
                {
                    "start": 14.57,
                    "end": 15.47,
                    "word": " attributed",
                    "probability": 0.6533203125
                },
                {
                    "start": 15.47,
                    "end": 15.79,
                    "word": " to",
                    "probability": 0.89892578125
                },
                {
                    "start": 15.79,
                    "end": 16.07,
                    "word": " the",
                    "probability": 0.79150390625
                },
                {
                    "start": 16.07,
                    "end": 16.51,
                    "word": " relatively",
                    "probability": 0.74560546875
                },
                {
                    "start": 16.51,
                    "end": 16.81,
                    "word": " new",
                    "probability": 0.80615234375
                },
                {
                    "start": 16.81,
                    "end": 17.03,
                    "word": " trade",
                    "probability": 0.42578125
                },
                {
                    "start": 17.03,
                    "end": 17.35,
                    "word": " actor",
                    "probability": 0.77734375
                }
            ]
        },
        {
            "id": 6,
            "seek": 2832,
            "start": 17.35,
            "end": 19.25,
            "text": " called Blue Mockingbird.",
            "tokens": [
                51214,
                1219,
                8510,
                376,
                31730,
                18080,
                13,
                51314
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2780123954420691,
            "compression_ratio": 1.6867924528301887,
            "no_speech_prob": 0.399169921875,
            "words": [
                {
                    "start": 17.35,
                    "end": 17.73,
                    "word": " called",
                    "probability": 0.7578125
                },
                {
                    "start": 17.73,
                    "end": 18.05,
                    "word": " Blue",
                    "probability": 0.79345703125
                },
                {
                    "start": 18.05,
                    "end": 18.61,
                    "word": " Mockingbird",
                    "probability": 0.9150390625
                },
                {
                    "start": 18.61,
                    "end": 19.25,
                    "word": ".",
                    "probability": 0.9384765625
                }
            ]
        },
        {
            "id": 7,
            "seek": 2832,
            "start": 20.03,
            "end": 23.07,
            "text": " But because we are in a recon village,",
            "tokens": [
                51364,
                583,
                570,
                321,
                366,
                294,
                257,
                9993,
                7288,
                11,
                51514
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2780123954420691,
            "compression_ratio": 1.6867924528301887,
            "no_speech_prob": 0.399169921875,
            "words": [
                {
                    "start": 20.03,
                    "end": 20.55,
                    "word": " But",
                    "probability": 0.86181640625
                },
                {
                    "start": 20.55,
                    "end": 20.97,
                    "word": " because",
                    "probability": 0.7822265625
                },
                {
                    "start": 20.97,
                    "end": 21.21,
                    "word": " we",
                    "probability": 0.9033203125
                },
                {
                    "start": 21.21,
                    "end": 21.43,
                    "word": " are",
                    "probability": 0.88232421875
                },
                {
                    "start": 21.43,
                    "end": 21.79,
                    "word": " in",
                    "probability": 0.896484375
                },
                {
                    "start": 22.11,
                    "end": 22.33,
                    "word": " a recon",
                    "probability": 0.138671875
                },
                {
                    "start": 22.33,
                    "end": 22.73,
                    "word": " village",
                    "probability": 0.84326171875
                },
                {
                    "start": 22.73,
                    "end": 23.07,
                    "word": ",",
                    "probability": 0.72705078125
                }
            ]
        },
        {
            "id": 8,
            "seek": 2832,
            "start": 23.07,
            "end": 26.39,
            "text": " this talk will not be about incident response only.",
            "tokens": [
                51514,
                341,
                751,
                486,
                406,
                312,
                466,
                9348,
                4134,
                787,
                13,
                51664
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2780123954420691,
            "compression_ratio": 1.6867924528301887,
            "no_speech_prob": 0.399169921875,
            "words": [
                {
                    "start": 23.07,
                    "end": 23.25,
                    "word": " this",
                    "probability": 0.87841796875
                },
                {
                    "start": 23.25,
                    "end": 23.59,
                    "word": " talk",
                    "probability": 0.80419921875
                },
                {
                    "start": 23.59,
                    "end": 23.83,
                    "word": " will",
                    "probability": 0.8115234375
                },
                {
                    "start": 23.83,
                    "end": 24.07,
                    "word": " not",
                    "probability": 0.87841796875
                },
                {
                    "start": 24.07,
                    "end": 24.37,
                    "word": " be",
                    "probability": 0.88916015625
                },
                {
                    "start": 24.37,
                    "end": 24.89,
                    "word": " about",
                    "probability": 0.81591796875
                },
                {
                    "start": 24.89,
                    "end": 25.27,
                    "word": " incident",
                    "probability": 0.87744140625
                },
                {
                    "start": 25.27,
                    "end": 25.71,
                    "word": " response",
                    "probability": 0.8876953125
                },
                {
                    "start": 25.71,
                    "end": 26.03,
                    "word": " only",
                    "probability": 0.8525390625
                },
                {
                    "start": 26.03,
                    "end": 26.39,
                    "word": ".",
                    "probability": 0.7900390625
                }
            ]
        },
        {
            "id": 9,
            "seek": 2832,
            "start": 26.39,
            "end": 28.67,
            "text": " Instead, I would like to share with you",
            "tokens": [
                51664,
                7156,
                11,
                286,
                576,
                411,
                281,
                2073,
                365,
                291,
                51814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2780123954420691,
            "compression_ratio": 1.6867924528301887,
            "no_speech_prob": 0.399169921875,
            "words": [
                {
                    "start": 26.39,
                    "end": 26.81,
                    "word": " Instead",
                    "probability": 0.904296875
                },
                {
                    "start": 26.81,
                    "end": 27.23,
                    "word": ",",
                    "probability": 0.84326171875
                },
                {
                    "start": 27.23,
                    "end": 27.41,
                    "word": " I",
                    "probability": 0.9970703125
                },
                {
                    "start": 27.41,
                    "end": 27.55,
                    "word": " would",
                    "probability": 0.8447265625
                },
                {
                    "start": 27.55,
                    "end": 27.77,
                    "word": " like",
                    "probability": 0.875
                },
                {
                    "start": 27.77,
                    "end": 27.93,
                    "word": " to",
                    "probability": 0.90283203125
                },
                {
                    "start": 27.93,
                    "end": 28.17,
                    "word": " share",
                    "probability": 0.7900390625
                },
                {
                    "start": 28.17,
                    "end": 28.39,
                    "word": " with",
                    "probability": 0.80029296875
                },
                {
                    "start": 28.39,
                    "end": 28.67,
                    "word": " you",
                    "probability": 0.89111328125
                }
            ]
        },
        {
            "id": 10,
            "seek": 5704,
            "start": 28.67,
            "end": 31.31,
            "text": " how our experiences have used reconnaissance",
            "tokens": [
                50364,
                577,
                527,
                5235,
                362,
                1143,
                31073,
                14431,
                50514
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22313084167854808,
            "compression_ratio": 1.7798507462686568,
            "no_speech_prob": 0.07421875,
            "words": [
                {
                    "start": 28.67,
                    "end": 29.29,
                    "word": " how",
                    "probability": 0.004772186279296875
                },
                {
                    "start": 29.29,
                    "end": 29.35,
                    "word": " our",
                    "probability": 0.00582122802734375
                },
                {
                    "start": 29.35,
                    "end": 29.91,
                    "word": " experiences",
                    "probability": 0.65185546875
                },
                {
                    "start": 29.91,
                    "end": 30.37,
                    "word": " have",
                    "probability": 0.7509765625
                },
                {
                    "start": 30.37,
                    "end": 30.77,
                    "word": " used",
                    "probability": 0.79150390625
                },
                {
                    "start": 30.77,
                    "end": 31.31,
                    "word": " reconnaissance",
                    "probability": 0.917724609375
                }
            ]
        },
        {
            "id": 11,
            "seek": 5704,
            "start": 31.31,
            "end": 33.29,
            "text": " and open source intelligence approaches",
            "tokens": [
                50514,
                293,
                1269,
                4009,
                7599,
                11587,
                50614
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22313084167854808,
            "compression_ratio": 1.7798507462686568,
            "no_speech_prob": 0.07421875,
            "words": [
                {
                    "start": 31.31,
                    "end": 31.75,
                    "word": " and",
                    "probability": 0.89111328125
                },
                {
                    "start": 31.75,
                    "end": 32.01,
                    "word": " open",
                    "probability": 0.72900390625
                },
                {
                    "start": 32.01,
                    "end": 32.25,
                    "word": " source",
                    "probability": 0.4619140625
                },
                {
                    "start": 32.25,
                    "end": 32.73,
                    "word": " intelligence",
                    "probability": 0.67431640625
                },
                {
                    "start": 32.73,
                    "end": 33.29,
                    "word": " approaches",
                    "probability": 0.681640625
                }
            ]
        },
        {
            "id": 12,
            "seek": 5704,
            "start": 33.29,
            "end": 37.57,
            "text": " to enrich our results from standard forensic and malware analysis.",
            "tokens": [
                50614,
                281,
                18849,
                527,
                3542,
                490,
                3832,
                39084,
                293,
                40747,
                5215,
                13,
                50814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22313084167854808,
            "compression_ratio": 1.7798507462686568,
            "no_speech_prob": 0.07421875,
            "words": [
                {
                    "start": 33.29,
                    "end": 33.89,
                    "word": " to",
                    "probability": 0.86767578125
                },
                {
                    "start": 33.89,
                    "end": 34.21,
                    "word": " enrich",
                    "probability": 0.66845703125
                },
                {
                    "start": 34.21,
                    "end": 34.57,
                    "word": " our",
                    "probability": 0.81396484375
                },
                {
                    "start": 34.57,
                    "end": 35.01,
                    "word": " results",
                    "probability": 0.6845703125
                },
                {
                    "start": 35.01,
                    "end": 35.29,
                    "word": " from",
                    "probability": 0.8115234375
                },
                {
                    "start": 35.29,
                    "end": 35.73,
                    "word": " standard",
                    "probability": 0.82275390625
                },
                {
                    "start": 35.73,
                    "end": 36.11,
                    "word": " forensic",
                    "probability": 0.57958984375
                },
                {
                    "start": 36.11,
                    "end": 36.29,
                    "word": " and",
                    "probability": 0.87939453125
                },
                {
                    "start": 36.29,
                    "end": 36.49,
                    "word": " malware",
                    "probability": 0.90576171875
                },
                {
                    "start": 36.49,
                    "end": 36.97,
                    "word": " analysis",
                    "probability": 0.60498046875
                },
                {
                    "start": 36.97,
                    "end": 37.57,
                    "word": ".",
                    "probability": 0.96630859375
                }
            ]
        },
        {
            "id": 13,
            "seek": 5704,
            "start": 37.59,
            "end": 40.83,
            "text": " As often happens, the attackers have deleted",
            "tokens": [
                50814,
                1018,
                2049,
                2314,
                11,
                264,
                45129,
                362,
                22981,
                50964
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22313084167854808,
            "compression_ratio": 1.7798507462686568,
            "no_speech_prob": 0.07421875,
            "words": [
                {
                    "start": 37.59,
                    "end": 37.81,
                    "word": " As",
                    "probability": 0.90576171875
                },
                {
                    "start": 37.81,
                    "end": 38.03,
                    "word": " often",
                    "probability": 0.734375
                },
                {
                    "start": 38.03,
                    "end": 38.51,
                    "word": " happens",
                    "probability": 0.90869140625
                },
                {
                    "start": 38.51,
                    "end": 39.01,
                    "word": ",",
                    "probability": 0.923828125
                },
                {
                    "start": 39.01,
                    "end": 39.09,
                    "word": " the",
                    "probability": 0.73388671875
                },
                {
                    "start": 39.09,
                    "end": 39.33,
                    "word": " attackers",
                    "probability": 0.5888671875
                },
                {
                    "start": 39.33,
                    "end": 40.47,
                    "word": " have",
                    "probability": 0.84423828125
                },
                {
                    "start": 40.47,
                    "end": 40.83,
                    "word": " deleted",
                    "probability": 0.81005859375
                }
            ]
        },
        {
            "id": 14,
            "seek": 5704,
            "start": 40.83,
            "end": 43.67,
            "text": " some of their tools after they used them.",
            "tokens": [
                50964,
                512,
                295,
                641,
                3873,
                934,
                436,
                1143,
                552,
                13,
                51114
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22313084167854808,
            "compression_ratio": 1.7798507462686568,
            "no_speech_prob": 0.07421875,
            "words": [
                {
                    "start": 40.83,
                    "end": 41.59,
                    "word": " some",
                    "probability": 0.814453125
                },
                {
                    "start": 41.59,
                    "end": 41.71,
                    "word": " of",
                    "probability": 0.91064453125
                },
                {
                    "start": 41.71,
                    "end": 41.89,
                    "word": " their",
                    "probability": 0.8759765625
                },
                {
                    "start": 41.89,
                    "end": 42.25,
                    "word": " tools",
                    "probability": 0.81787109375
                },
                {
                    "start": 42.25,
                    "end": 42.53,
                    "word": " after",
                    "probability": 0.732421875
                },
                {
                    "start": 42.53,
                    "end": 42.73,
                    "word": " they",
                    "probability": 0.73876953125
                },
                {
                    "start": 42.73,
                    "end": 42.93,
                    "word": " used",
                    "probability": 0.56689453125
                },
                {
                    "start": 42.93,
                    "end": 43.15,
                    "word": " them",
                    "probability": 0.74462890625
                },
                {
                    "start": 43.15,
                    "end": 43.67,
                    "word": ".",
                    "probability": 0.94580078125
                }
            ]
        },
        {
            "id": 15,
            "seek": 5704,
            "start": 43.67,
            "end": 47.05,
            "text": " However, with our recon and OSing approach,",
            "tokens": [
                51114,
                2908,
                11,
                365,
                527,
                9993,
                293,
                12731,
                278,
                3109,
                11,
                51264
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22313084167854808,
            "compression_ratio": 1.7798507462686568,
            "no_speech_prob": 0.07421875,
            "words": [
                {
                    "start": 43.67,
                    "end": 44.07,
                    "word": " However",
                    "probability": 0.8388671875
                },
                {
                    "start": 44.07,
                    "end": 44.71,
                    "word": ",",
                    "probability": 0.96875
                },
                {
                    "start": 44.71,
                    "end": 44.81,
                    "word": " with",
                    "probability": 0.787109375
                },
                {
                    "start": 44.81,
                    "end": 45.07,
                    "word": " our",
                    "probability": 0.798828125
                },
                {
                    "start": 45.07,
                    "end": 45.43,
                    "word": " recon",
                    "probability": 0.529296875
                },
                {
                    "start": 45.43,
                    "end": 45.73,
                    "word": " and",
                    "probability": 0.888671875
                },
                {
                    "start": 45.73,
                    "end": 46.15,
                    "word": " OSing",
                    "probability": 0.674072265625
                },
                {
                    "start": 46.15,
                    "end": 46.63,
                    "word": " approach",
                    "probability": 0.78564453125
                },
                {
                    "start": 46.63,
                    "end": 47.05,
                    "word": ",",
                    "probability": 0.82275390625
                }
            ]
        },
        {
            "id": 16,
            "seek": 5704,
            "start": 47.05,
            "end": 49.99,
            "text": " we were able to find them and reconstruct the original attack",
            "tokens": [
                51264,
                321,
                645,
                1075,
                281,
                915,
                552,
                293,
                31499,
                264,
                3380,
                2690,
                51414
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22313084167854808,
            "compression_ratio": 1.7798507462686568,
            "no_speech_prob": 0.07421875,
            "words": [
                {
                    "start": 47.05,
                    "end": 47.21,
                    "word": " we",
                    "probability": 0.8955078125
                },
                {
                    "start": 47.21,
                    "end": 47.33,
                    "word": " were",
                    "probability": 0.517578125
                },
                {
                    "start": 47.33,
                    "end": 47.57,
                    "word": " able",
                    "probability": 0.8759765625
                },
                {
                    "start": 47.57,
                    "end": 47.73,
                    "word": " to",
                    "probability": 0.90869140625
                },
                {
                    "start": 47.73,
                    "end": 47.99,
                    "word": " find",
                    "probability": 0.81787109375
                },
                {
                    "start": 47.99,
                    "end": 48.21,
                    "word": " them",
                    "probability": 0.7421875
                },
                {
                    "start": 48.21,
                    "end": 48.43,
                    "word": " and",
                    "probability": 0.88232421875
                },
                {
                    "start": 48.43,
                    "end": 48.81,
                    "word": " reconstruct",
                    "probability": 0.8388671875
                },
                {
                    "start": 48.81,
                    "end": 49.23,
                    "word": " the",
                    "probability": 0.81787109375
                },
                {
                    "start": 49.23,
                    "end": 49.67,
                    "word": " original",
                    "probability": 0.84521484375
                },
                {
                    "start": 49.67,
                    "end": 49.99,
                    "word": " attack",
                    "probability": 0.7890625
                }
            ]
        },
        {
            "id": 17,
            "seek": 5704,
            "start": 49.99,
            "end": 51.67,
            "text": " performed by the attackers.",
            "tokens": [
                51414,
                10332,
                538,
                264,
                45129,
                13,
                51514
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22313084167854808,
            "compression_ratio": 1.7798507462686568,
            "no_speech_prob": 0.07421875,
            "words": [
                {
                    "start": 49.99,
                    "end": 50.41,
                    "word": " performed",
                    "probability": 0.708984375
                },
                {
                    "start": 50.41,
                    "end": 50.67,
                    "word": " by",
                    "probability": 0.91162109375
                },
                {
                    "start": 50.67,
                    "end": 50.87,
                    "word": " the",
                    "probability": 0.80224609375
                },
                {
                    "start": 50.87,
                    "end": 51.07,
                    "word": " attackers",
                    "probability": 0.80078125
                },
                {
                    "start": 51.07,
                    "end": 51.67,
                    "word": ".",
                    "probability": 0.9912109375
                }
            ]
        },
        {
            "id": 18,
            "seek": 5704,
            "start": 51.85,
            "end": 54.61,
            "text": " Moreover, we were able to track origin of the malware",
            "tokens": [
                51514,
                19838,
                11,
                321,
                645,
                1075,
                281,
                2837,
                4957,
                295,
                264,
                40747,
                51664
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22313084167854808,
            "compression_ratio": 1.7798507462686568,
            "no_speech_prob": 0.07421875,
            "words": [
                {
                    "start": 51.85,
                    "end": 52.17,
                    "word": " Moreover",
                    "probability": 0.7392578125
                },
                {
                    "start": 52.17,
                    "end": 52.67,
                    "word": ",",
                    "probability": 0.9912109375
                },
                {
                    "start": 52.67,
                    "end": 52.83,
                    "word": " we",
                    "probability": 0.9013671875
                },
                {
                    "start": 52.83,
                    "end": 52.97,
                    "word": " were",
                    "probability": 0.869140625
                },
                {
                    "start": 52.97,
                    "end": 53.23,
                    "word": " able",
                    "probability": 0.87158203125
                },
                {
                    "start": 53.23,
                    "end": 53.39,
                    "word": " to",
                    "probability": 0.9091796875
                },
                {
                    "start": 53.39,
                    "end": 53.61,
                    "word": " track",
                    "probability": 0.82470703125
                },
                {
                    "start": 53.61,
                    "end": 53.97,
                    "word": " origin",
                    "probability": 0.413330078125
                },
                {
                    "start": 53.97,
                    "end": 54.21,
                    "word": " of",
                    "probability": 0.90576171875
                },
                {
                    "start": 54.21,
                    "end": 54.37,
                    "word": " the",
                    "probability": 0.80126953125
                },
                {
                    "start": 54.37,
                    "end": 54.61,
                    "word": " malware",
                    "probability": 0.86181640625
                }
            ]
        },
        {
            "id": 19,
            "seek": 5704,
            "start": 54.61,
            "end": 57.39,
            "text": " and we got insight into the technical capabilities",
            "tokens": [
                51664,
                293,
                321,
                658,
                11269,
                666,
                264,
                6191,
                10862,
                51814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22313084167854808,
            "compression_ratio": 1.7798507462686568,
            "no_speech_prob": 0.07421875,
            "words": [
                {
                    "start": 54.61,
                    "end": 55.37,
                    "word": " and",
                    "probability": 0.425048828125
                },
                {
                    "start": 55.37,
                    "end": 55.51,
                    "word": " we",
                    "probability": 0.87109375
                },
                {
                    "start": 55.51,
                    "end": 55.73,
                    "word": " got",
                    "probability": 0.88623046875
                },
                {
                    "start": 55.73,
                    "end": 56.15,
                    "word": " insight",
                    "probability": 0.75146484375
                },
                {
                    "start": 56.15,
                    "end": 56.35,
                    "word": " into",
                    "probability": 0.7412109375
                },
                {
                    "start": 56.35,
                    "end": 56.53,
                    "word": " the",
                    "probability": 0.81201171875
                },
                {
                    "start": 56.53,
                    "end": 56.81,
                    "word": " technical",
                    "probability": 0.83056640625
                },
                {
                    "start": 56.81,
                    "end": 57.39,
                    "word": " capabilities",
                    "probability": 0.81396484375
                }
            ]
        },
        {
            "id": 20,
            "seek": 8556,
            "start": 57.39,
            "end": 59.69,
            "text": " of the Blue Mockingbird trade actor.",
            "tokens": [
                50364,
                295,
                264,
                8510,
                376,
                31730,
                18080,
                4923,
                8747,
                13,
                50464
            ],
            "temperature": 0.0,
            "avg_logprob": -0.20773565647054892,
            "compression_ratio": 1.5812274368231047,
            "no_speech_prob": 0.02886962890625,
            "words": [
                {
                    "start": 57.39,
                    "end": 57.75,
                    "word": " of",
                    "probability": 0.334228515625
                },
                {
                    "start": 57.75,
                    "end": 57.93,
                    "word": " the",
                    "probability": 0.810546875
                },
                {
                    "start": 57.93,
                    "end": 58.09,
                    "word": " Blue",
                    "probability": 0.498046875
                },
                {
                    "start": 58.09,
                    "end": 58.61,
                    "word": " Mockingbird",
                    "probability": 0.7853190104166666
                },
                {
                    "start": 58.61,
                    "end": 58.87,
                    "word": " trade",
                    "probability": 0.0051116943359375
                },
                {
                    "start": 58.87,
                    "end": 59.17,
                    "word": " actor",
                    "probability": 0.32568359375
                },
                {
                    "start": 59.17,
                    "end": 59.69,
                    "word": ".",
                    "probability": 0.8447265625
                }
            ]
        },
        {
            "id": 21,
            "seek": 8556,
            "start": 59.83,
            "end": 61.77,
            "text": " And finally, in some cases,",
            "tokens": [
                50464,
                400,
                2721,
                11,
                294,
                512,
                3331,
                11,
                50564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.20773565647054892,
            "compression_ratio": 1.5812274368231047,
            "no_speech_prob": 0.02886962890625,
            "words": [
                {
                    "start": 59.83,
                    "end": 59.95,
                    "word": " And",
                    "probability": 0.78515625
                },
                {
                    "start": 59.95,
                    "end": 60.27,
                    "word": " finally",
                    "probability": 0.77978515625
                },
                {
                    "start": 60.27,
                    "end": 60.53,
                    "word": ",",
                    "probability": 0.8740234375
                },
                {
                    "start": 60.53,
                    "end": 60.69,
                    "word": " in",
                    "probability": 0.89990234375
                },
                {
                    "start": 60.69,
                    "end": 60.89,
                    "word": " some",
                    "probability": 0.81298828125
                },
                {
                    "start": 60.89,
                    "end": 61.33,
                    "word": " cases",
                    "probability": 0.79736328125
                },
                {
                    "start": 61.33,
                    "end": 61.77,
                    "word": ",",
                    "probability": 0.8212890625
                }
            ]
        },
        {
            "id": 22,
            "seek": 8556,
            "start": 61.77,
            "end": 65.97,
            "text": " we could track the incomings of the cryptocurrency wallets",
            "tokens": [
                50564,
                321,
                727,
                2837,
                264,
                14036,
                1109,
                295,
                264,
                28809,
                2929,
                1385,
                50764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.20773565647054892,
            "compression_ratio": 1.5812274368231047,
            "no_speech_prob": 0.02886962890625,
            "words": [
                {
                    "start": 61.77,
                    "end": 61.87,
                    "word": " we",
                    "probability": 0.615234375
                },
                {
                    "start": 61.87,
                    "end": 62.01,
                    "word": " could",
                    "probability": 0.822265625
                },
                {
                    "start": 62.01,
                    "end": 62.37,
                    "word": " track",
                    "probability": 0.70947265625
                },
                {
                    "start": 62.37,
                    "end": 62.85,
                    "word": " the",
                    "probability": 0.79248046875
                },
                {
                    "start": 62.85,
                    "end": 63.37,
                    "word": " incomings",
                    "probability": 0.757568359375
                },
                {
                    "start": 63.37,
                    "end": 64.77,
                    "word": " of",
                    "probability": 0.88525390625
                },
                {
                    "start": 64.77,
                    "end": 64.97,
                    "word": " the",
                    "probability": 0.80908203125
                },
                {
                    "start": 64.97,
                    "end": 65.41,
                    "word": " cryptocurrency",
                    "probability": 0.83349609375
                },
                {
                    "start": 65.41,
                    "end": 65.97,
                    "word": " wallets",
                    "probability": 0.737060546875
                }
            ]
        },
        {
            "id": 23,
            "seek": 8556,
            "start": 65.97,
            "end": 67.27,
            "text": " used by Blue Mockingbirds",
            "tokens": [
                50764,
                1143,
                538,
                8510,
                376,
                31730,
                31473,
                50864
            ],
            "temperature": 0.0,
            "avg_logprob": -0.20773565647054892,
            "compression_ratio": 1.5812274368231047,
            "no_speech_prob": 0.02886962890625,
            "words": [
                {
                    "start": 65.97,
                    "end": 66.33,
                    "word": " used",
                    "probability": 0.779296875
                },
                {
                    "start": 66.33,
                    "end": 66.53,
                    "word": " by",
                    "probability": 0.89794921875
                },
                {
                    "start": 66.53,
                    "end": 66.73,
                    "word": " Blue",
                    "probability": 0.8525390625
                },
                {
                    "start": 66.73,
                    "end": 67.27,
                    "word": " Mockingbirds",
                    "probability": 0.8194986979166666
                }
            ]
        },
        {
            "id": 24,
            "seek": 8556,
            "start": 67.27,
            "end": 69.75,
            "text": " and we can estimate profit of the attackers",
            "tokens": [
                50864,
                293,
                321,
                393,
                12539,
                7475,
                295,
                264,
                45129,
                50964
            ],
            "temperature": 0.0,
            "avg_logprob": -0.20773565647054892,
            "compression_ratio": 1.5812274368231047,
            "no_speech_prob": 0.02886962890625,
            "words": [
                {
                    "start": 67.27,
                    "end": 67.83,
                    "word": " and",
                    "probability": 0.36767578125
                },
                {
                    "start": 67.83,
                    "end": 67.97,
                    "word": " we",
                    "probability": 0.84814453125
                },
                {
                    "start": 67.97,
                    "end": 68.13,
                    "word": " can",
                    "probability": 0.8974609375
                },
                {
                    "start": 68.13,
                    "end": 68.63,
                    "word": " estimate",
                    "probability": 0.82275390625
                },
                {
                    "start": 68.63,
                    "end": 69.09,
                    "word": " profit",
                    "probability": 0.5576171875
                },
                {
                    "start": 69.09,
                    "end": 69.31,
                    "word": " of",
                    "probability": 0.90234375
                },
                {
                    "start": 69.31,
                    "end": 69.47,
                    "word": " the",
                    "probability": 0.8095703125
                },
                {
                    "start": 69.47,
                    "end": 69.75,
                    "word": " attackers",
                    "probability": 0.78955078125
                }
            ]
        },
        {
            "id": 25,
            "seek": 8556,
            "start": 69.75,
            "end": 73.59,
            "text": " and compare it with the damage they caused to their victims.",
            "tokens": [
                50964,
                293,
                6794,
                309,
                365,
                264,
                4344,
                436,
                7008,
                281,
                641,
                11448,
                13,
                51164
            ],
            "temperature": 0.0,
            "avg_logprob": -0.20773565647054892,
            "compression_ratio": 1.5812274368231047,
            "no_speech_prob": 0.02886962890625,
            "words": [
                {
                    "start": 69.75,
                    "end": 70.09,
                    "word": " and",
                    "probability": 0.8779296875
                },
                {
                    "start": 70.09,
                    "end": 70.41,
                    "word": " compare",
                    "probability": 0.85302734375
                },
                {
                    "start": 70.41,
                    "end": 70.61,
                    "word": " it",
                    "probability": 0.900390625
                },
                {
                    "start": 70.61,
                    "end": 70.77,
                    "word": " with",
                    "probability": 0.7802734375
                },
                {
                    "start": 70.77,
                    "end": 70.93,
                    "word": " the",
                    "probability": 0.806640625
                },
                {
                    "start": 70.93,
                    "end": 71.25,
                    "word": " damage",
                    "probability": 0.767578125
                },
                {
                    "start": 71.25,
                    "end": 71.51,
                    "word": " they",
                    "probability": 0.697265625
                },
                {
                    "start": 71.51,
                    "end": 72.35,
                    "word": " caused",
                    "probability": 0.65966796875
                },
                {
                    "start": 72.35,
                    "end": 72.51,
                    "word": " to",
                    "probability": 0.67041015625
                },
                {
                    "start": 72.51,
                    "end": 72.65,
                    "word": " their",
                    "probability": 0.853515625
                },
                {
                    "start": 72.65,
                    "end": 73.07,
                    "word": " victims",
                    "probability": 0.728515625
                },
                {
                    "start": 73.07,
                    "end": 73.59,
                    "word": ".",
                    "probability": 0.99267578125
                }
            ]
        },
        {
            "id": 26,
            "seek": 8556,
            "start": 74.81,
            "end": 76.77,
            "text": " So, this is our agenda.",
            "tokens": [
                51214,
                407,
                11,
                341,
                307,
                527,
                9829,
                13,
                51314
            ],
            "temperature": 0.0,
            "avg_logprob": -0.20773565647054892,
            "compression_ratio": 1.5812274368231047,
            "no_speech_prob": 0.02886962890625,
            "words": [
                {
                    "start": 74.81,
                    "end": 75.33,
                    "word": " So",
                    "probability": 0.8671875
                },
                {
                    "start": 75.33,
                    "end": 75.57,
                    "word": ",",
                    "probability": 0.4228515625
                },
                {
                    "start": 75.57,
                    "end": 75.73,
                    "word": " this",
                    "probability": 0.88232421875
                },
                {
                    "start": 75.73,
                    "end": 75.83,
                    "word": " is",
                    "probability": 0.90283203125
                },
                {
                    "start": 75.83,
                    "end": 76.07,
                    "word": " our",
                    "probability": 0.79638671875
                },
                {
                    "start": 76.07,
                    "end": 76.41,
                    "word": " agenda",
                    "probability": 0.77587890625
                },
                {
                    "start": 76.41,
                    "end": 76.77,
                    "word": ".",
                    "probability": 0.435791015625
                }
            ]
        },
        {
            "id": 27,
            "seek": 8556,
            "start": 76.77,
            "end": 78.93,
            "text": " And now, let me allow to introduce myself.",
            "tokens": [
                51314,
                400,
                586,
                11,
                718,
                385,
                2089,
                281,
                5366,
                2059,
                13,
                51414
            ],
            "temperature": 0.0,
            "avg_logprob": -0.20773565647054892,
            "compression_ratio": 1.5812274368231047,
            "no_speech_prob": 0.02886962890625,
            "words": [
                {
                    "start": 76.77,
                    "end": 76.93,
                    "word": " And",
                    "probability": 0.875
                },
                {
                    "start": 76.93,
                    "end": 77.11,
                    "word": " now",
                    "probability": 0.88134765625
                },
                {
                    "start": 77.11,
                    "end": 77.21,
                    "word": ",",
                    "probability": 0.48486328125
                },
                {
                    "start": 77.21,
                    "end": 77.29,
                    "word": " let",
                    "probability": 0.8330078125
                },
                {
                    "start": 77.29,
                    "end": 77.41,
                    "word": " me",
                    "probability": 0.908203125
                },
                {
                    "start": 77.41,
                    "end": 77.63,
                    "word": " allow",
                    "probability": 0.60400390625
                },
                {
                    "start": 77.63,
                    "end": 77.75,
                    "word": " to",
                    "probability": 0.88427734375
                },
                {
                    "start": 77.75,
                    "end": 78.05,
                    "word": " introduce",
                    "probability": 0.67236328125
                },
                {
                    "start": 78.05,
                    "end": 78.55,
                    "word": " myself",
                    "probability": 0.71875
                },
                {
                    "start": 78.55,
                    "end": 78.93,
                    "word": ".",
                    "probability": 0.9033203125
                }
            ]
        },
        {
            "id": 28,
            "seek": 8556,
            "start": 78.93,
            "end": 79.97,
            "text": " Who am I?",
            "tokens": [
                51414,
                2102,
                669,
                286,
                30,
                51514
            ],
            "temperature": 0.0,
            "avg_logprob": -0.20773565647054892,
            "compression_ratio": 1.5812274368231047,
            "no_speech_prob": 0.02886962890625,
            "words": [
                {
                    "start": 78.93,
                    "end": 79.09,
                    "word": " Who",
                    "probability": 0.837890625
                },
                {
                    "start": 79.09,
                    "end": 79.25,
                    "word": " am",
                    "probability": 0.91162109375
                },
                {
                    "start": 79.25,
                    "end": 79.45,
                    "word": " I",
                    "probability": 0.9970703125
                },
                {
                    "start": 79.45,
                    "end": 79.97,
                    "word": "?",
                    "probability": 0.98583984375
                }
            ]
        },
        {
            "id": 29,
            "seek": 8556,
            "start": 80.15,
            "end": 82.35,
            "text": " I am Vladislav Bačov and I currently work",
            "tokens": [
                51514,
                286,
                669,
                21958,
                5788,
                706,
                6777,
                10236,
                5179,
                293,
                286,
                4362,
                589,
                51614
            ],
            "temperature": 0.0,
            "avg_logprob": -0.20773565647054892,
            "compression_ratio": 1.5812274368231047,
            "no_speech_prob": 0.02886962890625,
            "words": [
                {
                    "start": 80.15,
                    "end": 80.63,
                    "word": " I",
                    "probability": 0.99755859375
                },
                {
                    "start": 80.63,
                    "end": 80.77,
                    "word": " am",
                    "probability": 0.765625
                },
                {
                    "start": 80.77,
                    "end": 81.13,
                    "word": " Vladislav",
                    "probability": 0.7421061197916666
                },
                {
                    "start": 81.13,
                    "end": 81.39,
                    "word": " Bačov",
                    "probability": 0.24648602803548178
                },
                {
                    "start": 81.39,
                    "end": 81.51,
                    "word": " and",
                    "probability": 0.62255859375
                },
                {
                    "start": 81.51,
                    "end": 81.67,
                    "word": " I",
                    "probability": 0.9931640625
                },
                {
                    "start": 81.67,
                    "end": 81.97,
                    "word": " currently",
                    "probability": 0.68310546875
                },
                {
                    "start": 81.97,
                    "end": 82.35,
                    "word": " work",
                    "probability": 0.80810546875
                }
            ]
        },
        {
            "id": 30,
            "seek": 8556,
            "start": 82.35,
            "end": 85.91,
            "text": " as a security senior consultant and malware analyst for Lifers,",
            "tokens": [
                51614,
                382,
                257,
                3825,
                7965,
                24676,
                293,
                40747,
                19085,
                337,
                31946,
                433,
                11,
                51764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.20773565647054892,
            "compression_ratio": 1.5812274368231047,
            "no_speech_prob": 0.02886962890625,
            "words": [
                {
                    "start": 82.35,
                    "end": 82.65,
                    "word": " as",
                    "probability": 0.91162109375
                },
                {
                    "start": 82.87,
                    "end": 83.19,
                    "word": " a security",
                    "probability": 0.433837890625
                },
                {
                    "start": 83.19,
                    "end": 83.43,
                    "word": " senior",
                    "probability": 0.791015625
                },
                {
                    "start": 83.43,
                    "end": 84.01,
                    "word": " consultant",
                    "probability": 0.744140625
                },
                {
                    "start": 84.01,
                    "end": 84.31,
                    "word": " and",
                    "probability": 0.8837890625
                },
                {
                    "start": 84.31,
                    "end": 84.53,
                    "word": " malware",
                    "probability": 0.8935546875
                },
                {
                    "start": 84.53,
                    "end": 84.89,
                    "word": " analyst",
                    "probability": 0.59423828125
                },
                {
                    "start": 84.89,
                    "end": 85.09,
                    "word": " for",
                    "probability": 0.89306640625
                },
                {
                    "start": 85.09,
                    "end": 85.49,
                    "word": " Lifers",
                    "probability": 0.6495361328125
                },
                {
                    "start": 85.49,
                    "end": 85.91,
                    "word": ",",
                    "probability": 0.8642578125
                }
            ]
        },
        {
            "id": 31,
            "seek": 11366,
            "start": 85.99,
            "end": 90.57,
            "text": " a New York City-based incident response and digital forensic company.",
            "tokens": [
                50364,
                257,
                1873,
                3609,
                4392,
                12,
                6032,
                9348,
                4134,
                293,
                4562,
                39084,
                2237,
                13,
                50564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2935267875389177,
            "compression_ratio": 1.4785992217898833,
            "no_speech_prob": 0.00576019287109375,
            "words": [
                {
                    "start": 85.99,
                    "end": 86.07,
                    "word": " a New",
                    "probability": 0.8193359375
                },
                {
                    "start": 86.07,
                    "end": 86.27,
                    "word": " York",
                    "probability": 0.94287109375
                },
                {
                    "start": 86.27,
                    "end": 86.43,
                    "word": " City",
                    "probability": 0.78125
                },
                {
                    "start": 86.43,
                    "end": 86.89,
                    "word": "-based",
                    "probability": 0.6593017578125
                },
                {
                    "start": 86.89,
                    "end": 87.33,
                    "word": " incident",
                    "probability": 0.75341796875
                },
                {
                    "start": 87.33,
                    "end": 87.89,
                    "word": " response",
                    "probability": 0.86669921875
                },
                {
                    "start": 87.89,
                    "end": 88.35,
                    "word": " and",
                    "probability": 0.87646484375
                },
                {
                    "start": 88.35,
                    "end": 89.15,
                    "word": " digital",
                    "probability": 0.85205078125
                },
                {
                    "start": 89.15,
                    "end": 89.57,
                    "word": " forensic",
                    "probability": 0.6552734375
                },
                {
                    "start": 89.57,
                    "end": 90.05,
                    "word": " company",
                    "probability": 0.806640625
                },
                {
                    "start": 90.05,
                    "end": 90.57,
                    "word": ".",
                    "probability": 0.97802734375
                }
            ]
        },
        {
            "id": 32,
            "seek": 11366,
            "start": 90.57,
            "end": 93.93,
            "text": " In the past, I also worked for the government of one European country",
            "tokens": [
                50614,
                682,
                264,
                1791,
                11,
                286,
                611,
                2732,
                337,
                264,
                2463,
                295,
                472,
                6473,
                1941,
                50764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2935267875389177,
            "compression_ratio": 1.4785992217898833,
            "no_speech_prob": 0.00576019287109375,
            "words": [
                {
                    "start": 90.57,
                    "end": 90.89,
                    "word": " In",
                    "probability": 0.9091796875
                },
                {
                    "start": 90.89,
                    "end": 91.05,
                    "word": " the",
                    "probability": 0.8115234375
                },
                {
                    "start": 91.05,
                    "end": 91.35,
                    "word": " past",
                    "probability": 0.80322265625
                },
                {
                    "start": 91.35,
                    "end": 91.39,
                    "word": ",",
                    "probability": 0.869140625
                },
                {
                    "start": 91.39,
                    "end": 91.49,
                    "word": " I",
                    "probability": 0.9990234375
                },
                {
                    "start": 91.49,
                    "end": 91.71,
                    "word": " also",
                    "probability": 0.79638671875
                },
                {
                    "start": 91.71,
                    "end": 92.01,
                    "word": " worked",
                    "probability": 0.7431640625
                },
                {
                    "start": 92.01,
                    "end": 92.23,
                    "word": " for",
                    "probability": 0.888671875
                },
                {
                    "start": 92.23,
                    "end": 92.33,
                    "word": " the",
                    "probability": 0.2783203125
                },
                {
                    "start": 92.33,
                    "end": 92.59,
                    "word": " government",
                    "probability": 0.77099609375
                },
                {
                    "start": 92.59,
                    "end": 92.89,
                    "word": " of",
                    "probability": 0.89306640625
                },
                {
                    "start": 92.89,
                    "end": 93.11,
                    "word": " one",
                    "probability": 0.802734375
                },
                {
                    "start": 93.11,
                    "end": 93.45,
                    "word": " European",
                    "probability": 0.6826171875
                },
                {
                    "start": 93.45,
                    "end": 93.93,
                    "word": " country",
                    "probability": 0.771484375
                }
            ]
        },
        {
            "id": 33,
            "seek": 11366,
            "start": 93.93,
            "end": 98.41,
            "text": " as an analyst in CSIRT, Computer Security Incident Response Team Slovakia.",
            "tokens": [
                50764,
                382,
                364,
                19085,
                294,
                9460,
                7740,
                51,
                11,
                22289,
                11164,
                7779,
                1078,
                43937,
                7606,
                22497,
                43506,
                654,
                13,
                50964
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2935267875389177,
            "compression_ratio": 1.4785992217898833,
            "no_speech_prob": 0.00576019287109375,
            "words": [
                {
                    "start": 93.93,
                    "end": 94.17,
                    "word": " as",
                    "probability": 0.853515625
                },
                {
                    "start": 94.17,
                    "end": 94.29,
                    "word": " an",
                    "probability": 0.5693359375
                },
                {
                    "start": 94.29,
                    "end": 94.55,
                    "word": " analyst",
                    "probability": 0.61376953125
                },
                {
                    "start": 94.55,
                    "end": 94.75,
                    "word": " in",
                    "probability": 0.8349609375
                },
                {
                    "start": 94.75,
                    "end": 95.19,
                    "word": " CSIRT",
                    "probability": 0.6656901041666666
                },
                {
                    "start": 95.19,
                    "end": 95.53,
                    "word": ",",
                    "probability": 0.79931640625
                },
                {
                    "start": 95.53,
                    "end": 95.81,
                    "word": " Computer",
                    "probability": 0.525390625
                },
                {
                    "start": 95.81,
                    "end": 96.25,
                    "word": " Security",
                    "probability": 0.82763671875
                },
                {
                    "start": 96.25,
                    "end": 96.55,
                    "word": " Incident",
                    "probability": 0.892822265625
                },
                {
                    "start": 96.55,
                    "end": 96.99,
                    "word": " Response",
                    "probability": 0.83984375
                },
                {
                    "start": 96.99,
                    "end": 97.17,
                    "word": " Team",
                    "probability": 0.84521484375
                },
                {
                    "start": 97.17,
                    "end": 97.73,
                    "word": " Slovakia",
                    "probability": 0.812255859375
                },
                {
                    "start": 97.73,
                    "end": 98.41,
                    "word": ".",
                    "probability": 0.984375
                }
            ]
        },
        {
            "id": 34,
            "seek": 11366,
            "start": 99.67,
            "end": 100.63,
            "text": " But now...",
            "tokens": [
                51064,
                583,
                586,
                485,
                51114
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2935267875389177,
            "compression_ratio": 1.4785992217898833,
            "no_speech_prob": 0.00576019287109375,
            "words": [
                {
                    "start": 99.67,
                    "end": 99.85,
                    "word": " But",
                    "probability": 0.465087890625
                },
                {
                    "start": 99.85,
                    "end": 100.63,
                    "word": " now...",
                    "probability": 0.4945068359375
                }
            ]
        },
        {
            "id": 35,
            "seek": 11366,
            "start": 101.89,
            "end": 102.23,
            "text": " Okay...",
            "tokens": [
                51114,
                1033,
                485,
                51164
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2935267875389177,
            "compression_ratio": 1.4785992217898833,
            "no_speech_prob": 0.00576019287109375,
            "words": [
                {
                    "start": 101.89,
                    "end": 102.23,
                    "word": " Okay...",
                    "probability": 0.26678466796875
                }
            ]
        },
        {
            "id": 36,
            "seek": 11366,
            "start": 102.57,
            "end": 105.17,
            "text": " We can ask one obvious question.",
            "tokens": [
                51214,
                492,
                393,
                1029,
                472,
                6322,
                1168,
                13,
                51314
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2935267875389177,
            "compression_ratio": 1.4785992217898833,
            "no_speech_prob": 0.00576019287109375,
            "words": [
                {
                    "start": 102.57,
                    "end": 103.19,
                    "word": " We",
                    "probability": 0.49853515625
                },
                {
                    "start": 103.19,
                    "end": 103.33,
                    "word": " can",
                    "probability": 0.892578125
                },
                {
                    "start": 103.33,
                    "end": 103.65,
                    "word": " ask",
                    "probability": 0.82275390625
                },
                {
                    "start": 103.65,
                    "end": 104.01,
                    "word": " one",
                    "probability": 0.7919921875
                },
                {
                    "start": 104.01,
                    "end": 104.35,
                    "word": " obvious",
                    "probability": 0.77392578125
                },
                {
                    "start": 104.35,
                    "end": 104.83,
                    "word": " question",
                    "probability": 0.80078125
                },
                {
                    "start": 104.83,
                    "end": 105.17,
                    "word": ".",
                    "probability": 0.74658203125
                }
            ]
        },
        {
            "id": 37,
            "seek": 11366,
            "start": 105.61,
            "end": 108.21,
            "text": " Why a presentation about malware analysis,",
            "tokens": [
                51314,
                1545,
                257,
                5860,
                466,
                40747,
                5215,
                11,
                51464
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2935267875389177,
            "compression_ratio": 1.4785992217898833,
            "no_speech_prob": 0.00576019287109375,
            "words": [
                {
                    "start": 105.61,
                    "end": 105.91,
                    "word": " Why",
                    "probability": 0.77392578125
                },
                {
                    "start": 106.05,
                    "end": 106.51,
                    "word": " a presentation",
                    "probability": 0.77685546875
                },
                {
                    "start": 106.51,
                    "end": 107.07,
                    "word": " about",
                    "probability": 0.81591796875
                },
                {
                    "start": 107.07,
                    "end": 107.45,
                    "word": " malware",
                    "probability": 0.80908203125
                },
                {
                    "start": 107.45,
                    "end": 107.97,
                    "word": " analysis",
                    "probability": 0.57177734375
                },
                {
                    "start": 107.97,
                    "end": 108.21,
                    "word": ",",
                    "probability": 0.96533203125
                }
            ]
        },
        {
            "id": 38,
            "seek": 11366,
            "start": 108.21,
            "end": 110.13,
            "text": " threat intelligence and OSing?",
            "tokens": [
                51464,
                4734,
                7599,
                293,
                12731,
                278,
                30,
                51564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2935267875389177,
            "compression_ratio": 1.4785992217898833,
            "no_speech_prob": 0.00576019287109375,
            "words": [
                {
                    "start": 108.21,
                    "end": 108.33,
                    "word": " threat",
                    "probability": 0.701171875
                },
                {
                    "start": 108.33,
                    "end": 108.93,
                    "word": " intelligence",
                    "probability": 0.6767578125
                },
                {
                    "start": 108.93,
                    "end": 109.29,
                    "word": " and",
                    "probability": 0.46923828125
                },
                {
                    "start": 109.29,
                    "end": 109.79,
                    "word": " OSing",
                    "probability": 0.4464530944824219
                },
                {
                    "start": 109.79,
                    "end": 110.13,
                    "word": "?",
                    "probability": 0.95703125
                }
            ]
        },
        {
            "id": 39,
            "seek": 11366,
            "start": 110.73,
            "end": 114.01,
            "text": " There are a lot of automated solutions,",
            "tokens": [
                51614,
                821,
                366,
                257,
                688,
                295,
                18473,
                6547,
                11,
                51764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2935267875389177,
            "compression_ratio": 1.4785992217898833,
            "no_speech_prob": 0.00576019287109375,
            "words": [
                {
                    "start": 110.73,
                    "end": 111.15,
                    "word": " There",
                    "probability": 0.80029296875
                },
                {
                    "start": 111.15,
                    "end": 112.27,
                    "word": " are",
                    "probability": 0.88720703125
                },
                {
                    "start": 112.47,
                    "end": 112.61,
                    "word": " a lot",
                    "probability": 0.8798828125
                },
                {
                    "start": 112.61,
                    "end": 112.81,
                    "word": " of",
                    "probability": 0.8974609375
                },
                {
                    "start": 112.81,
                    "end": 113.23,
                    "word": " automated",
                    "probability": 0.912109375
                },
                {
                    "start": 113.23,
                    "end": 113.79,
                    "word": " solutions",
                    "probability": 0.8447265625
                },
                {
                    "start": 113.79,
                    "end": 114.01,
                    "word": ",",
                    "probability": 0.322509765625
                }
            ]
        },
        {
            "id": 40,
            "seek": 14154,
            "start": 114.01,
            "end": 116.59,
            "text": " such as antivirus scanners and sandboxes.",
            "tokens": [
                50364,
                1270,
                382,
                2511,
                592,
                9619,
                795,
                25792,
                293,
                42115,
                279,
                13,
                50464
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21890169382095337,
            "compression_ratio": 1.68503937007874,
            "no_speech_prob": 0.0225982666015625,
            "words": [
                {
                    "start": 114.01,
                    "end": 114.15,
                    "word": " such",
                    "probability": 0.673828125
                },
                {
                    "start": 114.15,
                    "end": 114.39,
                    "word": " as",
                    "probability": 0.888671875
                },
                {
                    "start": 114.39,
                    "end": 114.97,
                    "word": " antivirus",
                    "probability": 0.81982421875
                },
                {
                    "start": 114.97,
                    "end": 115.37,
                    "word": " scanners",
                    "probability": 0.896728515625
                },
                {
                    "start": 115.37,
                    "end": 115.69,
                    "word": " and",
                    "probability": 0.86767578125
                },
                {
                    "start": 115.69,
                    "end": 116.27,
                    "word": " sandboxes",
                    "probability": 0.8720703125
                },
                {
                    "start": 116.27,
                    "end": 116.59,
                    "word": ".",
                    "probability": 0.8837890625
                }
            ]
        },
        {
            "id": 41,
            "seek": 14154,
            "start": 116.59,
            "end": 119.89,
            "text": " So, why do we need to bother with additional malware analysis",
            "tokens": [
                50464,
                407,
                11,
                983,
                360,
                321,
                643,
                281,
                8677,
                365,
                4497,
                40747,
                5215,
                50664
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21890169382095337,
            "compression_ratio": 1.68503937007874,
            "no_speech_prob": 0.0225982666015625,
            "words": [
                {
                    "start": 116.59,
                    "end": 116.71,
                    "word": " So",
                    "probability": 0.79931640625
                },
                {
                    "start": 116.71,
                    "end": 116.83,
                    "word": ",",
                    "probability": 0.209228515625
                },
                {
                    "start": 116.83,
                    "end": 117.01,
                    "word": " why",
                    "probability": 0.81689453125
                },
                {
                    "start": 117.01,
                    "end": 117.17,
                    "word": " do",
                    "probability": 0.90771484375
                },
                {
                    "start": 117.17,
                    "end": 117.31,
                    "word": " we",
                    "probability": 0.9013671875
                },
                {
                    "start": 117.31,
                    "end": 117.51,
                    "word": " need",
                    "probability": 0.80908203125
                },
                {
                    "start": 117.51,
                    "end": 117.69,
                    "word": " to",
                    "probability": 0.8994140625
                },
                {
                    "start": 117.69,
                    "end": 117.93,
                    "word": " bother",
                    "probability": 0.6904296875
                },
                {
                    "start": 117.93,
                    "end": 118.23,
                    "word": " with",
                    "probability": 0.7666015625
                },
                {
                    "start": 118.23,
                    "end": 118.65,
                    "word": " additional",
                    "probability": 0.7451171875
                },
                {
                    "start": 118.65,
                    "end": 118.97,
                    "word": " malware",
                    "probability": 0.92431640625
                },
                {
                    "start": 118.97,
                    "end": 119.89,
                    "word": " analysis",
                    "probability": 0.42724609375
                }
            ]
        },
        {
            "id": 42,
            "seek": 14154,
            "start": 119.89,
            "end": 124.09,
            "text": " and enrichments with info from another public sources,",
            "tokens": [
                50664,
                293,
                18849,
                1117,
                365,
                13614,
                490,
                1071,
                1908,
                7139,
                11,
                50864
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21890169382095337,
            "compression_ratio": 1.68503937007874,
            "no_speech_prob": 0.0225982666015625,
            "words": [
                {
                    "start": 119.89,
                    "end": 120.17,
                    "word": " and",
                    "probability": 0.8720703125
                },
                {
                    "start": 120.17,
                    "end": 120.89,
                    "word": " enrichments",
                    "probability": 0.7373046875
                },
                {
                    "start": 120.89,
                    "end": 121.77,
                    "word": " with",
                    "probability": 0.7138671875
                },
                {
                    "start": 121.77,
                    "end": 122.19,
                    "word": " info",
                    "probability": 0.6484375
                },
                {
                    "start": 122.19,
                    "end": 122.55,
                    "word": " from",
                    "probability": 0.822265625
                },
                {
                    "start": 122.55,
                    "end": 122.85,
                    "word": " another",
                    "probability": 0.64208984375
                },
                {
                    "start": 122.85,
                    "end": 123.21,
                    "word": " public",
                    "probability": 0.85400390625
                },
                {
                    "start": 123.21,
                    "end": 123.69,
                    "word": " sources",
                    "probability": 0.6513671875
                },
                {
                    "start": 123.69,
                    "end": 124.09,
                    "word": ",",
                    "probability": 0.299560546875
                }
            ]
        },
        {
            "id": 43,
            "seek": 14154,
            "start": 124.09,
            "end": 128.37,
            "text": " if those automated solutions can identify most of the common threats?",
            "tokens": [
                50864,
                498,
                729,
                18473,
                6547,
                393,
                5876,
                881,
                295,
                264,
                2689,
                14909,
                30,
                51064
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21890169382095337,
            "compression_ratio": 1.68503937007874,
            "no_speech_prob": 0.0225982666015625,
            "words": [
                {
                    "start": 124.09,
                    "end": 124.27,
                    "word": " if",
                    "probability": 0.89111328125
                },
                {
                    "start": 124.27,
                    "end": 124.53,
                    "word": " those",
                    "probability": 0.828125
                },
                {
                    "start": 124.53,
                    "end": 124.95,
                    "word": " automated",
                    "probability": 0.74072265625
                },
                {
                    "start": 124.95,
                    "end": 125.55,
                    "word": " solutions",
                    "probability": 0.84228515625
                },
                {
                    "start": 125.55,
                    "end": 126.01,
                    "word": " can",
                    "probability": 0.89306640625
                },
                {
                    "start": 126.01,
                    "end": 126.47,
                    "word": " identify",
                    "probability": 0.87890625
                },
                {
                    "start": 126.47,
                    "end": 127.07,
                    "word": " most",
                    "probability": 0.8076171875
                },
                {
                    "start": 127.07,
                    "end": 127.23,
                    "word": " of",
                    "probability": 0.9052734375
                },
                {
                    "start": 127.23,
                    "end": 127.37,
                    "word": " the",
                    "probability": 0.8154296875
                },
                {
                    "start": 127.37,
                    "end": 127.61,
                    "word": " common",
                    "probability": 0.701171875
                },
                {
                    "start": 127.61,
                    "end": 127.91,
                    "word": " threats",
                    "probability": 0.6328125
                },
                {
                    "start": 127.91,
                    "end": 128.37,
                    "word": "?",
                    "probability": 0.87548828125
                }
            ]
        },
        {
            "id": 44,
            "seek": 14154,
            "start": 128.37,
            "end": 132.09,
            "text": " Well, the answer is hidden in the previous sentence.",
            "tokens": [
                51064,
                1042,
                11,
                264,
                1867,
                307,
                7633,
                294,
                264,
                3894,
                8174,
                13,
                51264
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21890169382095337,
            "compression_ratio": 1.68503937007874,
            "no_speech_prob": 0.0225982666015625,
            "words": [
                {
                    "start": 128.37,
                    "end": 128.77,
                    "word": " Well",
                    "probability": 0.7236328125
                },
                {
                    "start": 128.77,
                    "end": 129.29,
                    "word": ",",
                    "probability": 0.98291015625
                },
                {
                    "start": 129.29,
                    "end": 129.53,
                    "word": " the",
                    "probability": 0.79443359375
                },
                {
                    "start": 129.53,
                    "end": 129.71,
                    "word": " answer",
                    "probability": 0.8974609375
                },
                {
                    "start": 129.71,
                    "end": 129.93,
                    "word": " is",
                    "probability": 0.9033203125
                },
                {
                    "start": 129.93,
                    "end": 130.23,
                    "word": " hidden",
                    "probability": 0.3837890625
                },
                {
                    "start": 130.23,
                    "end": 130.59,
                    "word": " in",
                    "probability": 0.8984375
                },
                {
                    "start": 130.59,
                    "end": 130.69,
                    "word": " the",
                    "probability": 0.81689453125
                },
                {
                    "start": 130.69,
                    "end": 130.99,
                    "word": " previous",
                    "probability": 0.68359375
                },
                {
                    "start": 130.99,
                    "end": 131.49,
                    "word": " sentence",
                    "probability": 0.82763671875
                },
                {
                    "start": 131.49,
                    "end": 132.09,
                    "word": ".",
                    "probability": 0.9326171875
                }
            ]
        },
        {
            "id": 45,
            "seek": 14154,
            "start": 132.57,
            "end": 136.17,
            "text": " They can identify the most of the common threats.",
            "tokens": [
                51264,
                814,
                393,
                5876,
                264,
                881,
                295,
                264,
                2689,
                14909,
                13,
                51464
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21890169382095337,
            "compression_ratio": 1.68503937007874,
            "no_speech_prob": 0.0225982666015625,
            "words": [
                {
                    "start": 132.57,
                    "end": 132.79,
                    "word": " They",
                    "probability": 0.7392578125
                },
                {
                    "start": 132.79,
                    "end": 133.05,
                    "word": " can",
                    "probability": 0.90869140625
                },
                {
                    "start": 133.05,
                    "end": 133.77,
                    "word": " identify",
                    "probability": 0.85205078125
                },
                {
                    "start": 133.77,
                    "end": 134.33,
                    "word": " the",
                    "probability": 0.72412109375
                },
                {
                    "start": 134.33,
                    "end": 134.69,
                    "word": " most",
                    "probability": 0.8154296875
                },
                {
                    "start": 134.69,
                    "end": 134.91,
                    "word": " of",
                    "probability": 0.89599609375
                },
                {
                    "start": 134.91,
                    "end": 135.07,
                    "word": " the",
                    "probability": 0.814453125
                },
                {
                    "start": 135.07,
                    "end": 135.33,
                    "word": " common",
                    "probability": 0.71826171875
                },
                {
                    "start": 135.33,
                    "end": 135.71,
                    "word": " threats",
                    "probability": 0.77783203125
                },
                {
                    "start": 135.71,
                    "end": 136.17,
                    "word": ".",
                    "probability": 0.58984375
                }
            ]
        },
        {
            "id": 46,
            "seek": 14154,
            "start": 136.17,
            "end": 139.09,
            "text": " And I would like to emphasize the word common.",
            "tokens": [
                51464,
                400,
                286,
                576,
                411,
                281,
                16078,
                264,
                1349,
                2689,
                13,
                51614
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21890169382095337,
            "compression_ratio": 1.68503937007874,
            "no_speech_prob": 0.0225982666015625,
            "words": [
                {
                    "start": 136.17,
                    "end": 136.31,
                    "word": " And",
                    "probability": 0.8154296875
                },
                {
                    "start": 136.31,
                    "end": 136.41,
                    "word": " I",
                    "probability": 0.89892578125
                },
                {
                    "start": 136.41,
                    "end": 136.53,
                    "word": " would",
                    "probability": 0.8486328125
                },
                {
                    "start": 136.53,
                    "end": 136.77,
                    "word": " like",
                    "probability": 0.87451171875
                },
                {
                    "start": 136.77,
                    "end": 136.93,
                    "word": " to",
                    "probability": 0.908203125
                },
                {
                    "start": 136.93,
                    "end": 137.27,
                    "word": " emphasize",
                    "probability": 0.7939453125
                },
                {
                    "start": 137.27,
                    "end": 137.69,
                    "word": " the",
                    "probability": 0.81201171875
                },
                {
                    "start": 137.69,
                    "end": 138.01,
                    "word": " word",
                    "probability": 0.7958984375
                },
                {
                    "start": 138.01,
                    "end": 138.49,
                    "word": " common",
                    "probability": 0.348876953125
                },
                {
                    "start": 138.49,
                    "end": 139.09,
                    "word": ".",
                    "probability": 0.9609375
                }
            ]
        },
        {
            "id": 47,
            "seek": 14154,
            "start": 139.69,
            "end": 141.89,
            "text": " When you need to deal with advanced threat actors",
            "tokens": [
                51614,
                1133,
                291,
                643,
                281,
                2028,
                365,
                7339,
                4734,
                10037,
                51764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21890169382095337,
            "compression_ratio": 1.68503937007874,
            "no_speech_prob": 0.0225982666015625,
            "words": [
                {
                    "start": 139.69,
                    "end": 139.89,
                    "word": " When",
                    "probability": 0.80126953125
                },
                {
                    "start": 139.89,
                    "end": 139.99,
                    "word": " you",
                    "probability": 0.88232421875
                },
                {
                    "start": 139.99,
                    "end": 140.21,
                    "word": " need",
                    "probability": 0.810546875
                },
                {
                    "start": 140.21,
                    "end": 140.39,
                    "word": " to",
                    "probability": 0.90625
                },
                {
                    "start": 140.39,
                    "end": 140.65,
                    "word": " deal",
                    "probability": 0.92236328125
                },
                {
                    "start": 140.65,
                    "end": 140.91,
                    "word": " with",
                    "probability": 0.81494140625
                },
                {
                    "start": 140.91,
                    "end": 141.31,
                    "word": " advanced",
                    "probability": 0.8251953125
                },
                {
                    "start": 141.31,
                    "end": 141.51,
                    "word": " threat",
                    "probability": 0.88720703125
                },
                {
                    "start": 141.51,
                    "end": 141.89,
                    "word": " actors",
                    "probability": 0.7861328125
                }
            ]
        },
        {
            "id": 48,
            "seek": 16890,
            "start": 141.89,
            "end": 147.31,
            "text": " or uncommon threats, such as rare or obfuscated malware samples,",
            "tokens": [
                50364,
                420,
                29289,
                14909,
                11,
                1270,
                382,
                5892,
                420,
                1111,
                69,
                32601,
                770,
                40747,
                10938,
                11,
                50614
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22088068859143692,
            "compression_ratio": 1.6153846153846154,
            "no_speech_prob": 0.0189208984375,
            "words": [
                {
                    "start": 141.89,
                    "end": 142.37,
                    "word": " or",
                    "probability": 0.2939453125
                },
                {
                    "start": 142.37,
                    "end": 142.85,
                    "word": " uncommon",
                    "probability": 0.5869140625
                },
                {
                    "start": 142.85,
                    "end": 143.39,
                    "word": " threats",
                    "probability": 0.693359375
                },
                {
                    "start": 143.39,
                    "end": 143.81,
                    "word": ",",
                    "probability": 0.396728515625
                },
                {
                    "start": 143.81,
                    "end": 143.99,
                    "word": " such",
                    "probability": 0.89599609375
                },
                {
                    "start": 143.99,
                    "end": 144.19,
                    "word": " as",
                    "probability": 0.91064453125
                },
                {
                    "start": 144.19,
                    "end": 144.47,
                    "word": " rare",
                    "probability": 0.68994140625
                },
                {
                    "start": 144.47,
                    "end": 144.77,
                    "word": " or",
                    "probability": 0.88134765625
                },
                {
                    "start": 144.77,
                    "end": 145.67,
                    "word": " obfuscated",
                    "probability": 0.9547119140625
                },
                {
                    "start": 145.67,
                    "end": 145.93,
                    "word": " malware",
                    "probability": 0.81982421875
                },
                {
                    "start": 145.93,
                    "end": 146.45,
                    "word": " samples",
                    "probability": 0.75439453125
                },
                {
                    "start": 146.45,
                    "end": 147.31,
                    "word": ",",
                    "probability": 0.74169921875
                }
            ]
        },
        {
            "id": 49,
            "seek": 16890,
            "start": 147.31,
            "end": 153.53,
            "text": " they can stay undetected by many of antivirus scanners and sandboxes.",
            "tokens": [
                50614,
                436,
                393,
                1754,
                674,
                302,
                39963,
                538,
                867,
                295,
                2511,
                592,
                9619,
                795,
                25792,
                293,
                42115,
                279,
                13,
                50914
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22088068859143692,
            "compression_ratio": 1.6153846153846154,
            "no_speech_prob": 0.0189208984375,
            "words": [
                {
                    "start": 147.31,
                    "end": 147.91,
                    "word": " they",
                    "probability": 0.64111328125
                },
                {
                    "start": 147.91,
                    "end": 148.11,
                    "word": " can",
                    "probability": 0.89892578125
                },
                {
                    "start": 148.11,
                    "end": 148.37,
                    "word": " stay",
                    "probability": 0.9130859375
                },
                {
                    "start": 148.37,
                    "end": 148.93,
                    "word": " undetected",
                    "probability": 0.95703125
                },
                {
                    "start": 148.93,
                    "end": 149.63,
                    "word": " by",
                    "probability": 0.9052734375
                },
                {
                    "start": 149.63,
                    "end": 150.39,
                    "word": " many",
                    "probability": 0.73486328125
                },
                {
                    "start": 150.39,
                    "end": 150.69,
                    "word": " of",
                    "probability": 0.77685546875
                },
                {
                    "start": 150.69,
                    "end": 151.45,
                    "word": " antivirus",
                    "probability": 0.7997233072916666
                },
                {
                    "start": 151.45,
                    "end": 151.91,
                    "word": " scanners",
                    "probability": 0.89208984375
                },
                {
                    "start": 151.91,
                    "end": 152.31,
                    "word": " and",
                    "probability": 0.88916015625
                },
                {
                    "start": 152.31,
                    "end": 153.01,
                    "word": " sandboxes",
                    "probability": 0.921875
                },
                {
                    "start": 153.01,
                    "end": 153.53,
                    "word": ".",
                    "probability": 0.97802734375
                }
            ]
        },
        {
            "id": 50,
            "seek": 16890,
            "start": 153.53,
            "end": 158.33,
            "text": " On the other hand, malware analysts can perform a brief analysis of those samples.",
            "tokens": [
                50914,
                1282,
                264,
                661,
                1011,
                11,
                40747,
                31388,
                393,
                2042,
                257,
                5353,
                5215,
                295,
                729,
                10938,
                13,
                51164
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22088068859143692,
            "compression_ratio": 1.6153846153846154,
            "no_speech_prob": 0.0189208984375,
            "words": [
                {
                    "start": 153.53,
                    "end": 153.69,
                    "word": " On",
                    "probability": 0.8701171875
                },
                {
                    "start": 153.69,
                    "end": 153.85,
                    "word": " the",
                    "probability": 0.810546875
                },
                {
                    "start": 153.85,
                    "end": 154.01,
                    "word": " other",
                    "probability": 0.767578125
                },
                {
                    "start": 154.01,
                    "end": 154.29,
                    "word": " hand",
                    "probability": 0.79248046875
                },
                {
                    "start": 154.29,
                    "end": 154.49,
                    "word": ",",
                    "probability": 0.95556640625
                },
                {
                    "start": 154.49,
                    "end": 154.65,
                    "word": " malware",
                    "probability": 0.7900390625
                },
                {
                    "start": 154.65,
                    "end": 155.07,
                    "word": " analysts",
                    "probability": 0.625
                },
                {
                    "start": 155.07,
                    "end": 155.29,
                    "word": " can",
                    "probability": 0.89599609375
                },
                {
                    "start": 155.29,
                    "end": 155.71,
                    "word": " perform",
                    "probability": 0.806640625
                },
                {
                    "start": 156.23,
                    "end": 156.45,
                    "word": " a brief",
                    "probability": 0.9033203125
                },
                {
                    "start": 156.45,
                    "end": 156.87,
                    "word": " analysis",
                    "probability": 0.73193359375
                },
                {
                    "start": 156.87,
                    "end": 157.13,
                    "word": " of",
                    "probability": 0.90771484375
                },
                {
                    "start": 157.13,
                    "end": 157.35,
                    "word": " those",
                    "probability": 0.6796875
                },
                {
                    "start": 157.35,
                    "end": 157.75,
                    "word": " samples",
                    "probability": 0.7529296875
                },
                {
                    "start": 157.75,
                    "end": 158.33,
                    "word": ".",
                    "probability": 0.344970703125
                }
            ]
        },
        {
            "id": 51,
            "seek": 16890,
            "start": 158.33,
            "end": 163.29,
            "text": " And moreover, if they enrich the better results with intelligence info,",
            "tokens": [
                51164,
                400,
                544,
                3570,
                11,
                498,
                436,
                18849,
                264,
                1101,
                3542,
                365,
                7599,
                13614,
                11,
                51414
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22088068859143692,
            "compression_ratio": 1.6153846153846154,
            "no_speech_prob": 0.0189208984375,
            "words": [
                {
                    "start": 158.33,
                    "end": 158.47,
                    "word": " And",
                    "probability": 0.75390625
                },
                {
                    "start": 158.47,
                    "end": 158.93,
                    "word": " moreover",
                    "probability": 0.857666015625
                },
                {
                    "start": 158.93,
                    "end": 159.17,
                    "word": ",",
                    "probability": 0.97802734375
                },
                {
                    "start": 159.17,
                    "end": 159.27,
                    "word": " if",
                    "probability": 0.89453125
                },
                {
                    "start": 159.27,
                    "end": 159.51,
                    "word": " they",
                    "probability": 0.73828125
                },
                {
                    "start": 159.51,
                    "end": 159.95,
                    "word": " enrich",
                    "probability": 0.49755859375
                },
                {
                    "start": 159.95,
                    "end": 160.19,
                    "word": " the",
                    "probability": 0.791015625
                },
                {
                    "start": 160.19,
                    "end": 160.39,
                    "word": " better",
                    "probability": 0.11956787109375
                },
                {
                    "start": 160.39,
                    "end": 160.93,
                    "word": " results",
                    "probability": 0.31005859375
                },
                {
                    "start": 160.93,
                    "end": 161.49,
                    "word": " with",
                    "probability": 0.79248046875
                },
                {
                    "start": 161.49,
                    "end": 162.09,
                    "word": " intelligence",
                    "probability": 0.43408203125
                },
                {
                    "start": 162.09,
                    "end": 162.55,
                    "word": " info",
                    "probability": 0.6796875
                },
                {
                    "start": 162.55,
                    "end": 163.29,
                    "word": ",",
                    "probability": 0.955078125
                }
            ]
        },
        {
            "id": 52,
            "seek": 16890,
            "start": 163.29,
            "end": 169.25,
            "text": " they can quickly provide the rest of the team with accurate report.",
            "tokens": [
                51414,
                436,
                393,
                2661,
                2893,
                264,
                1472,
                295,
                264,
                1469,
                365,
                8559,
                2275,
                13,
                51714
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22088068859143692,
            "compression_ratio": 1.6153846153846154,
            "no_speech_prob": 0.0189208984375,
            "words": [
                {
                    "start": 163.29,
                    "end": 163.51,
                    "word": " they",
                    "probability": 0.7275390625
                },
                {
                    "start": 163.51,
                    "end": 163.87,
                    "word": " can",
                    "probability": 0.89306640625
                },
                {
                    "start": 163.87,
                    "end": 164.85,
                    "word": " quickly",
                    "probability": 0.84912109375
                },
                {
                    "start": 164.85,
                    "end": 165.73,
                    "word": " provide",
                    "probability": 0.90380859375
                },
                {
                    "start": 165.73,
                    "end": 166.55,
                    "word": " the",
                    "probability": 0.8046875
                },
                {
                    "start": 166.55,
                    "end": 166.79,
                    "word": " rest",
                    "probability": 0.8076171875
                },
                {
                    "start": 166.79,
                    "end": 166.93,
                    "word": " of",
                    "probability": 0.90673828125
                },
                {
                    "start": 166.93,
                    "end": 167.09,
                    "word": " the",
                    "probability": 0.810546875
                },
                {
                    "start": 167.09,
                    "end": 167.37,
                    "word": " team",
                    "probability": 0.92529296875
                },
                {
                    "start": 167.37,
                    "end": 167.73,
                    "word": " with",
                    "probability": 0.78515625
                },
                {
                    "start": 167.73,
                    "end": 168.07,
                    "word": " accurate",
                    "probability": 0.51171875
                },
                {
                    "start": 168.07,
                    "end": 168.63,
                    "word": " report",
                    "probability": 0.6416015625
                },
                {
                    "start": 168.63,
                    "end": 169.25,
                    "word": ".",
                    "probability": 0.921875
                }
            ]
        },
        {
            "id": 53,
            "seek": 19268,
            "start": 169.25,
            "end": 173.49,
            "text": " And this report can include not only the purpose and capabilities of the malware,",
            "tokens": [
                50364,
                400,
                341,
                2275,
                393,
                4090,
                406,
                787,
                264,
                4334,
                293,
                10862,
                295,
                264,
                40747,
                11,
                50564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2161144578313253,
            "compression_ratio": 1.6409090909090909,
            "no_speech_prob": 0.04302978515625,
            "words": [
                {
                    "start": 169.25,
                    "end": 169.45,
                    "word": " And",
                    "probability": 0.331787109375
                },
                {
                    "start": 169.45,
                    "end": 169.61,
                    "word": " this",
                    "probability": 0.76416015625
                },
                {
                    "start": 169.61,
                    "end": 170.01,
                    "word": " report",
                    "probability": 0.8017578125
                },
                {
                    "start": 170.01,
                    "end": 170.25,
                    "word": " can",
                    "probability": 0.8935546875
                },
                {
                    "start": 170.25,
                    "end": 170.69,
                    "word": " include",
                    "probability": 0.775390625
                },
                {
                    "start": 170.69,
                    "end": 170.95,
                    "word": " not",
                    "probability": 0.865234375
                },
                {
                    "start": 170.95,
                    "end": 171.19,
                    "word": " only",
                    "probability": 0.85595703125
                },
                {
                    "start": 171.19,
                    "end": 171.37,
                    "word": " the",
                    "probability": 0.81005859375
                },
                {
                    "start": 171.37,
                    "end": 171.65,
                    "word": " purpose",
                    "probability": 0.2459716796875
                },
                {
                    "start": 171.65,
                    "end": 171.97,
                    "word": " and",
                    "probability": 0.8662109375
                },
                {
                    "start": 171.97,
                    "end": 172.49,
                    "word": " capabilities",
                    "probability": 0.79248046875
                },
                {
                    "start": 172.49,
                    "end": 172.69,
                    "word": " of",
                    "probability": 0.8994140625
                },
                {
                    "start": 172.69,
                    "end": 172.83,
                    "word": " the",
                    "probability": 0.7890625
                },
                {
                    "start": 172.83,
                    "end": 173.09,
                    "word": " malware",
                    "probability": 0.876953125
                },
                {
                    "start": 173.09,
                    "end": 173.49,
                    "word": ",",
                    "probability": 0.72802734375
                }
            ]
        },
        {
            "id": 54,
            "seek": 19268,
            "start": 173.49,
            "end": 178.54,
            "text": " but also origin of the samples or attributions to the threat actors.",
            "tokens": [
                50564,
                457,
                611,
                4957,
                295,
                264,
                10938,
                420,
                9080,
                3666,
                281,
                264,
                4734,
                10037,
                13,
                50814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2161144578313253,
            "compression_ratio": 1.6409090909090909,
            "no_speech_prob": 0.04302978515625,
            "words": [
                {
                    "start": 173.49,
                    "end": 173.73,
                    "word": " but",
                    "probability": 0.8955078125
                },
                {
                    "start": 173.73,
                    "end": 174.23,
                    "word": " also",
                    "probability": 0.8271484375
                },
                {
                    "start": 174.23,
                    "end": 175.17,
                    "word": " origin",
                    "probability": 0.5791015625
                },
                {
                    "start": 175.17,
                    "end": 175.47,
                    "word": " of",
                    "probability": 0.90478515625
                },
                {
                    "start": 175.47,
                    "end": 175.61,
                    "word": " the",
                    "probability": 0.80615234375
                },
                {
                    "start": 175.61,
                    "end": 176.09,
                    "word": " samples",
                    "probability": 0.7802734375
                },
                {
                    "start": 176.09,
                    "end": 176.67,
                    "word": " or",
                    "probability": 0.7353515625
                },
                {
                    "start": 176.67,
                    "end": 177.35,
                    "word": " attributions",
                    "probability": 0.89208984375
                },
                {
                    "start": 177.35,
                    "end": 177.53,
                    "word": " to",
                    "probability": 0.89990234375
                },
                {
                    "start": 177.53,
                    "end": 177.65,
                    "word": " the",
                    "probability": 0.81005859375
                },
                {
                    "start": 177.65,
                    "end": 177.83,
                    "word": " threat",
                    "probability": 0.775390625
                },
                {
                    "start": 177.83,
                    "end": 178.23,
                    "word": " actors",
                    "probability": 0.802734375
                },
                {
                    "start": 178.23,
                    "end": 178.54,
                    "word": ".",
                    "probability": 0.97265625
                }
            ]
        },
        {
            "id": 55,
            "seek": 19268,
            "start": 179.19,
            "end": 183.41,
            "text": " It can also help to reveal yet undiscovered steps of attacker,",
            "tokens": [
                50814,
                467,
                393,
                611,
                854,
                281,
                10658,
                1939,
                674,
                40080,
                292,
                4439,
                295,
                35871,
                11,
                51064
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2161144578313253,
            "compression_ratio": 1.6409090909090909,
            "no_speech_prob": 0.04302978515625,
            "words": [
                {
                    "start": 179.19,
                    "end": 179.37,
                    "word": " It",
                    "probability": 0.87646484375
                },
                {
                    "start": 179.37,
                    "end": 179.51,
                    "word": " can",
                    "probability": 0.8984375
                },
                {
                    "start": 179.51,
                    "end": 179.81,
                    "word": " also",
                    "probability": 0.81494140625
                },
                {
                    "start": 179.81,
                    "end": 180.09,
                    "word": " help",
                    "probability": 0.7861328125
                },
                {
                    "start": 180.09,
                    "end": 180.25,
                    "word": " to",
                    "probability": 0.8974609375
                },
                {
                    "start": 180.25,
                    "end": 180.61,
                    "word": " reveal",
                    "probability": 0.88134765625
                },
                {
                    "start": 180.61,
                    "end": 180.97,
                    "word": " yet",
                    "probability": 0.82177734375
                },
                {
                    "start": 180.97,
                    "end": 181.77,
                    "word": " undiscovered",
                    "probability": 0.8077799479166666
                },
                {
                    "start": 181.77,
                    "end": 182.13,
                    "word": " steps",
                    "probability": 0.708984375
                },
                {
                    "start": 182.13,
                    "end": 182.45,
                    "word": " of",
                    "probability": 0.90673828125
                },
                {
                    "start": 182.45,
                    "end": 182.79,
                    "word": " attacker",
                    "probability": 0.63330078125
                },
                {
                    "start": 182.79,
                    "end": 183.41,
                    "word": ",",
                    "probability": 0.471923828125
                }
            ]
        },
        {
            "id": 56,
            "seek": 19268,
            "start": 183.41,
            "end": 188.48,
            "text": " as well as it can recover yet missing pieces of malware puzzle used by attacker.",
            "tokens": [
                51064,
                382,
                731,
                382,
                309,
                393,
                8114,
                1939,
                5361,
                3755,
                295,
                40747,
                12805,
                1143,
                538,
                35871,
                13,
                51314
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2161144578313253,
            "compression_ratio": 1.6409090909090909,
            "no_speech_prob": 0.04302978515625,
            "words": [
                {
                    "start": 183.41,
                    "end": 183.89,
                    "word": " as",
                    "probability": 0.89697265625
                },
                {
                    "start": 183.89,
                    "end": 184.15,
                    "word": " well",
                    "probability": 0.88134765625
                },
                {
                    "start": 184.15,
                    "end": 184.39,
                    "word": " as",
                    "probability": 0.89599609375
                },
                {
                    "start": 184.39,
                    "end": 184.51,
                    "word": " it",
                    "probability": 0.8837890625
                },
                {
                    "start": 184.51,
                    "end": 184.69,
                    "word": " can",
                    "probability": 0.9033203125
                },
                {
                    "start": 184.69,
                    "end": 185.15,
                    "word": " recover",
                    "probability": 0.61376953125
                },
                {
                    "start": 185.15,
                    "end": 185.51,
                    "word": " yet",
                    "probability": 0.85205078125
                },
                {
                    "start": 185.51,
                    "end": 185.83,
                    "word": " missing",
                    "probability": 0.8076171875
                },
                {
                    "start": 185.83,
                    "end": 186.27,
                    "word": " pieces",
                    "probability": 0.87353515625
                },
                {
                    "start": 186.27,
                    "end": 186.57,
                    "word": " of",
                    "probability": 0.90185546875
                },
                {
                    "start": 186.57,
                    "end": 186.85,
                    "word": " malware",
                    "probability": 0.8662109375
                },
                {
                    "start": 186.85,
                    "end": 187.25,
                    "word": " puzzle",
                    "probability": 0.5869140625
                },
                {
                    "start": 187.25,
                    "end": 187.71,
                    "word": " used",
                    "probability": 0.7880859375
                },
                {
                    "start": 187.71,
                    "end": 187.91,
                    "word": " by",
                    "probability": 0.9140625
                },
                {
                    "start": 187.91,
                    "end": 188.17,
                    "word": " attacker",
                    "probability": 0.70947265625
                },
                {
                    "start": 188.17,
                    "end": 188.48,
                    "word": ".",
                    "probability": 0.984375
                }
            ]
        },
        {
            "id": 57,
            "seek": 19268,
            "start": 188.85,
            "end": 193.03,
            "text": " And last but not least, this brief analysis with intelligence data",
            "tokens": [
                51314,
                400,
                1036,
                457,
                406,
                1935,
                11,
                341,
                5353,
                5215,
                365,
                7599,
                1412,
                51564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2161144578313253,
            "compression_ratio": 1.6409090909090909,
            "no_speech_prob": 0.04302978515625,
            "words": [
                {
                    "start": 188.85,
                    "end": 189.05,
                    "word": " And",
                    "probability": 0.87451171875
                },
                {
                    "start": 189.05,
                    "end": 189.41,
                    "word": " last",
                    "probability": 0.8017578125
                },
                {
                    "start": 189.41,
                    "end": 189.63,
                    "word": " but",
                    "probability": 0.7431640625
                },
                {
                    "start": 189.63,
                    "end": 189.83,
                    "word": " not",
                    "probability": 0.896484375
                },
                {
                    "start": 189.83,
                    "end": 190.15,
                    "word": " least",
                    "probability": 0.8447265625
                },
                {
                    "start": 190.15,
                    "end": 190.71,
                    "word": ",",
                    "probability": 0.91650390625
                },
                {
                    "start": 190.71,
                    "end": 190.91,
                    "word": " this",
                    "probability": 0.3837890625
                },
                {
                    "start": 190.91,
                    "end": 191.19,
                    "word": " brief",
                    "probability": 0.8916015625
                },
                {
                    "start": 191.19,
                    "end": 191.69,
                    "word": " analysis",
                    "probability": 0.6826171875
                },
                {
                    "start": 191.69,
                    "end": 192.19,
                    "word": " with",
                    "probability": 0.8115234375
                },
                {
                    "start": 192.19,
                    "end": 192.63,
                    "word": " intelligence",
                    "probability": 0.67724609375
                },
                {
                    "start": 192.63,
                    "end": 193.03,
                    "word": " data",
                    "probability": 0.81201171875
                }
            ]
        },
        {
            "id": 58,
            "seek": 21816,
            "start": 193.03,
            "end": 199.37,
            "text": " can collect more indicator of compromise relevant for threat intelligence,",
            "tokens": [
                50364,
                393,
                2500,
                544,
                16961,
                295,
                18577,
                7340,
                337,
                4734,
                7599,
                11,
                50664
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2675189326206843,
            "compression_ratio": 1.5513513513513513,
            "no_speech_prob": 0.0972900390625,
            "words": [
                {
                    "start": 193.03,
                    "end": 193.89,
                    "word": " can",
                    "probability": 0.60888671875
                },
                {
                    "start": 193.89,
                    "end": 194.37,
                    "word": " collect",
                    "probability": 0.80810546875
                },
                {
                    "start": 194.37,
                    "end": 194.99,
                    "word": " more",
                    "probability": 0.86865234375
                },
                {
                    "start": 194.99,
                    "end": 195.51,
                    "word": " indicator",
                    "probability": 0.53662109375
                },
                {
                    "start": 195.51,
                    "end": 195.71,
                    "word": " of",
                    "probability": 0.88330078125
                },
                {
                    "start": 195.71,
                    "end": 196.35,
                    "word": " compromise",
                    "probability": 0.7109375
                },
                {
                    "start": 196.35,
                    "end": 197.29,
                    "word": " relevant",
                    "probability": 0.521484375
                },
                {
                    "start": 197.29,
                    "end": 198.17,
                    "word": " for",
                    "probability": 0.88671875
                },
                {
                    "start": 198.17,
                    "end": 198.45,
                    "word": " threat",
                    "probability": 0.560546875
                },
                {
                    "start": 198.45,
                    "end": 198.87,
                    "word": " intelligence",
                    "probability": 0.77978515625
                },
                {
                    "start": 198.87,
                    "end": 199.37,
                    "word": ",",
                    "probability": 0.7646484375
                }
            ]
        },
        {
            "id": 59,
            "seek": 21816,
            "start": 199.37,
            "end": 202.17,
            "text": " for threat hunting and monitoring team.",
            "tokens": [
                50664,
                337,
                4734,
                12599,
                293,
                11028,
                1469,
                13,
                50864
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2675189326206843,
            "compression_ratio": 1.5513513513513513,
            "no_speech_prob": 0.0972900390625,
            "words": [
                {
                    "start": 199.37,
                    "end": 199.71,
                    "word": " for",
                    "probability": 0.83544921875
                },
                {
                    "start": 199.71,
                    "end": 199.89,
                    "word": " threat",
                    "probability": 0.7353515625
                },
                {
                    "start": 199.89,
                    "end": 200.27,
                    "word": " hunting",
                    "probability": 0.7275390625
                },
                {
                    "start": 200.27,
                    "end": 200.63,
                    "word": " and",
                    "probability": 0.640625
                },
                {
                    "start": 200.63,
                    "end": 201.05,
                    "word": " monitoring",
                    "probability": 0.783203125
                },
                {
                    "start": 201.05,
                    "end": 201.45,
                    "word": " team",
                    "probability": 0.78271484375
                },
                {
                    "start": 201.45,
                    "end": 202.17,
                    "word": ".",
                    "probability": 0.9599609375
                }
            ]
        },
        {
            "id": 60,
            "seek": 21816,
            "start": 204.29,
            "end": 209.85,
            "text": " And when we are talking about using threat intelligence fees and other data sources,",
            "tokens": [
                50864,
                400,
                562,
                321,
                366,
                1417,
                466,
                1228,
                4734,
                7599,
                13370,
                293,
                661,
                1412,
                7139,
                11,
                51164
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2675189326206843,
            "compression_ratio": 1.5513513513513513,
            "no_speech_prob": 0.0972900390625,
            "words": [
                {
                    "start": 204.29,
                    "end": 205.01,
                    "word": " And",
                    "probability": 0.8076171875
                },
                {
                    "start": 205.01,
                    "end": 205.33,
                    "word": " when",
                    "probability": 0.806640625
                },
                {
                    "start": 205.33,
                    "end": 205.47,
                    "word": " we",
                    "probability": 0.9013671875
                },
                {
                    "start": 205.47,
                    "end": 205.61,
                    "word": " are",
                    "probability": 0.85888671875
                },
                {
                    "start": 205.61,
                    "end": 206.05,
                    "word": " talking",
                    "probability": 0.76123046875
                },
                {
                    "start": 206.05,
                    "end": 206.63,
                    "word": " about",
                    "probability": 0.81005859375
                },
                {
                    "start": 206.63,
                    "end": 206.95,
                    "word": " using",
                    "probability": 0.814453125
                },
                {
                    "start": 206.95,
                    "end": 207.21,
                    "word": " threat",
                    "probability": 0.80908203125
                },
                {
                    "start": 207.21,
                    "end": 207.65,
                    "word": " intelligence",
                    "probability": 0.658203125
                },
                {
                    "start": 207.65,
                    "end": 207.95,
                    "word": " fees",
                    "probability": 0.363037109375
                },
                {
                    "start": 207.95,
                    "end": 208.25,
                    "word": " and",
                    "probability": 0.87353515625
                },
                {
                    "start": 208.25,
                    "end": 208.49,
                    "word": " other",
                    "probability": 0.7822265625
                },
                {
                    "start": 208.49,
                    "end": 208.69,
                    "word": " data",
                    "probability": 0.79443359375
                },
                {
                    "start": 208.69,
                    "end": 209.05,
                    "word": " sources",
                    "probability": 0.72705078125
                },
                {
                    "start": 209.05,
                    "end": 209.85,
                    "word": ",",
                    "probability": 0.86767578125
                }
            ]
        },
        {
            "id": 61,
            "seek": 21816,
            "start": 209.85,
            "end": 212.31,
            "text": " we can search for many attributes.",
            "tokens": [
                51164,
                321,
                393,
                3164,
                337,
                867,
                17212,
                13,
                51314
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2675189326206843,
            "compression_ratio": 1.5513513513513513,
            "no_speech_prob": 0.0972900390625,
            "words": [
                {
                    "start": 209.85,
                    "end": 210.03,
                    "word": " we",
                    "probability": 0.89453125
                },
                {
                    "start": 210.03,
                    "end": 210.23,
                    "word": " can",
                    "probability": 0.89697265625
                },
                {
                    "start": 210.23,
                    "end": 210.65,
                    "word": " search",
                    "probability": 0.935546875
                },
                {
                    "start": 210.65,
                    "end": 210.97,
                    "word": " for",
                    "probability": 0.89501953125
                },
                {
                    "start": 210.97,
                    "end": 211.37,
                    "word": " many",
                    "probability": 0.810546875
                },
                {
                    "start": 211.37,
                    "end": 211.95,
                    "word": " attributes",
                    "probability": 0.716796875
                },
                {
                    "start": 211.95,
                    "end": 212.31,
                    "word": ".",
                    "probability": 0.83056640625
                }
            ]
        },
        {
            "id": 62,
            "seek": 21816,
            "start": 212.95,
            "end": 218.51,
            "text": " There are obvious ones like URLs, hashes, and so on.",
            "tokens": [
                51314,
                821,
                366,
                6322,
                2306,
                411,
                43267,
                11,
                575,
                8076,
                11,
                293,
                370,
                322,
                13,
                51614
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2675189326206843,
            "compression_ratio": 1.5513513513513513,
            "no_speech_prob": 0.0972900390625,
            "words": [
                {
                    "start": 212.95,
                    "end": 213.13,
                    "word": " There",
                    "probability": 0.47705078125
                },
                {
                    "start": 213.13,
                    "end": 213.41,
                    "word": " are",
                    "probability": 0.884765625
                },
                {
                    "start": 213.41,
                    "end": 214.51,
                    "word": " obvious",
                    "probability": 0.7421875
                },
                {
                    "start": 214.51,
                    "end": 214.87,
                    "word": " ones",
                    "probability": 0.61669921875
                },
                {
                    "start": 214.87,
                    "end": 215.45,
                    "word": " like",
                    "probability": 0.66748046875
                },
                {
                    "start": 215.45,
                    "end": 216.97,
                    "word": " URLs",
                    "probability": 0.66357421875
                },
                {
                    "start": 216.97,
                    "end": 217.21,
                    "word": ",",
                    "probability": 0.94580078125
                },
                {
                    "start": 217.21,
                    "end": 217.49,
                    "word": " hashes",
                    "probability": 0.842529296875
                },
                {
                    "start": 217.49,
                    "end": 217.63,
                    "word": ",",
                    "probability": 0.35888671875
                },
                {
                    "start": 217.63,
                    "end": 217.73,
                    "word": " and",
                    "probability": 0.8779296875
                },
                {
                    "start": 217.73,
                    "end": 217.87,
                    "word": " so",
                    "probability": 0.90380859375
                },
                {
                    "start": 217.87,
                    "end": 218.09,
                    "word": " on",
                    "probability": 0.91162109375
                },
                {
                    "start": 218.09,
                    "end": 218.51,
                    "word": ".",
                    "probability": 0.64697265625
                }
            ]
        },
        {
            "id": 63,
            "seek": 24764,
            "start": 218.51,
            "end": 223.45,
            "text": " But in addition, very helpful can be searched by file name, regular expressions,",
            "tokens": [
                50364,
                583,
                294,
                4500,
                11,
                588,
                4961,
                393,
                312,
                22961,
                538,
                3991,
                1315,
                11,
                3890,
                15277,
                11,
                50614
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2323638684678786,
            "compression_ratio": 1.6758893280632412,
            "no_speech_prob": 0.01348876953125,
            "words": [
                {
                    "start": 218.51,
                    "end": 218.79,
                    "word": " But",
                    "probability": 0.638671875
                },
                {
                    "start": 218.79,
                    "end": 218.97,
                    "word": " in",
                    "probability": 0.81884765625
                },
                {
                    "start": 218.97,
                    "end": 219.39,
                    "word": " addition",
                    "probability": 0.89697265625
                },
                {
                    "start": 219.39,
                    "end": 219.87,
                    "word": ",",
                    "probability": 0.88525390625
                },
                {
                    "start": 219.87,
                    "end": 220.03,
                    "word": " very",
                    "probability": 0.5341796875
                },
                {
                    "start": 220.03,
                    "end": 220.37,
                    "word": " helpful",
                    "probability": 0.80615234375
                },
                {
                    "start": 220.37,
                    "end": 220.71,
                    "word": " can",
                    "probability": 0.85546875
                },
                {
                    "start": 220.71,
                    "end": 220.87,
                    "word": " be",
                    "probability": 0.8984375
                },
                {
                    "start": 220.87,
                    "end": 221.21,
                    "word": " searched",
                    "probability": 0.491943359375
                },
                {
                    "start": 221.21,
                    "end": 221.53,
                    "word": " by",
                    "probability": 0.896484375
                },
                {
                    "start": 221.53,
                    "end": 221.87,
                    "word": " file",
                    "probability": 0.52001953125
                },
                {
                    "start": 221.87,
                    "end": 222.15,
                    "word": " name",
                    "probability": 0.78759765625
                },
                {
                    "start": 222.15,
                    "end": 222.25,
                    "word": ",",
                    "probability": 0.8701171875
                },
                {
                    "start": 222.25,
                    "end": 222.49,
                    "word": " regular",
                    "probability": 0.9404296875
                },
                {
                    "start": 222.49,
                    "end": 223.09,
                    "word": " expressions",
                    "probability": 0.828125
                },
                {
                    "start": 223.09,
                    "end": 223.45,
                    "word": ",",
                    "probability": 0.479248046875
                }
            ]
        },
        {
            "id": 64,
            "seek": 24764,
            "start": 223.45,
            "end": 227.55,
            "text": " and malware classifications, such as categories and tags.",
            "tokens": [
                50614,
                293,
                40747,
                1508,
                7833,
                11,
                1270,
                382,
                10479,
                293,
                18632,
                13,
                50814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2323638684678786,
            "compression_ratio": 1.6758893280632412,
            "no_speech_prob": 0.01348876953125,
            "words": [
                {
                    "start": 223.45,
                    "end": 223.57,
                    "word": " and",
                    "probability": 0.86767578125
                },
                {
                    "start": 223.57,
                    "end": 223.87,
                    "word": " malware",
                    "probability": 0.84228515625
                },
                {
                    "start": 223.87,
                    "end": 224.65,
                    "word": " classifications",
                    "probability": 0.914306640625
                },
                {
                    "start": 224.65,
                    "end": 225.21,
                    "word": ",",
                    "probability": 0.51123046875
                },
                {
                    "start": 225.21,
                    "end": 225.47,
                    "word": " such",
                    "probability": 0.89501953125
                },
                {
                    "start": 225.47,
                    "end": 225.65,
                    "word": " as",
                    "probability": 0.91650390625
                },
                {
                    "start": 225.65,
                    "end": 226.11,
                    "word": " categories",
                    "probability": 0.78125
                },
                {
                    "start": 226.11,
                    "end": 226.61,
                    "word": " and",
                    "probability": 0.87060546875
                },
                {
                    "start": 226.61,
                    "end": 226.95,
                    "word": " tags",
                    "probability": 0.82861328125
                },
                {
                    "start": 226.95,
                    "end": 227.55,
                    "word": ".",
                    "probability": 0.9755859375
                }
            ]
        },
        {
            "id": 65,
            "seek": 24764,
            "start": 227.55,
            "end": 231.73,
            "text": " Also, search for strings embedded in the malware or search by import hashes",
            "tokens": [
                50814,
                2743,
                11,
                3164,
                337,
                13985,
                16741,
                294,
                264,
                40747,
                420,
                3164,
                538,
                974,
                575,
                8076,
                51014
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2323638684678786,
            "compression_ratio": 1.6758893280632412,
            "no_speech_prob": 0.01348876953125,
            "words": [
                {
                    "start": 227.55,
                    "end": 227.87,
                    "word": " Also",
                    "probability": 0.875
                },
                {
                    "start": 227.87,
                    "end": 228.01,
                    "word": ",",
                    "probability": 0.473876953125
                },
                {
                    "start": 228.01,
                    "end": 228.23,
                    "word": " search",
                    "probability": 0.87060546875
                },
                {
                    "start": 228.23,
                    "end": 228.39,
                    "word": " for",
                    "probability": 0.8984375
                },
                {
                    "start": 228.39,
                    "end": 228.75,
                    "word": " strings",
                    "probability": 0.78955078125
                },
                {
                    "start": 228.75,
                    "end": 229.09,
                    "word": " embedded",
                    "probability": 0.62109375
                },
                {
                    "start": 229.09,
                    "end": 229.31,
                    "word": " in",
                    "probability": 0.90576171875
                },
                {
                    "start": 229.31,
                    "end": 229.43,
                    "word": " the",
                    "probability": 0.74951171875
                },
                {
                    "start": 229.43,
                    "end": 229.75,
                    "word": " malware",
                    "probability": 0.86962890625
                },
                {
                    "start": 229.75,
                    "end": 230.35,
                    "word": " or",
                    "probability": 0.58251953125
                },
                {
                    "start": 230.35,
                    "end": 230.69,
                    "word": " search",
                    "probability": 0.8828125
                },
                {
                    "start": 230.69,
                    "end": 230.93,
                    "word": " by",
                    "probability": 0.904296875
                },
                {
                    "start": 230.93,
                    "end": 231.31,
                    "word": " import",
                    "probability": 0.7001953125
                },
                {
                    "start": 231.31,
                    "end": 231.73,
                    "word": " hashes",
                    "probability": 0.838623046875
                }
            ]
        },
        {
            "id": 66,
            "seek": 24764,
            "start": 231.73,
            "end": 238.67,
            "text": " can discover more similar samples, which can be linked to the same attacks or to the same threat actors.",
            "tokens": [
                51014,
                393,
                4411,
                544,
                2531,
                10938,
                11,
                597,
                393,
                312,
                9408,
                281,
                264,
                912,
                951,
                7424,
                420,
                281,
                264,
                912,
                4734,
                10037,
                13,
                51414
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2323638684678786,
            "compression_ratio": 1.6758893280632412,
            "no_speech_prob": 0.01348876953125,
            "words": [
                {
                    "start": 231.73,
                    "end": 232.03,
                    "word": " can",
                    "probability": 0.8603515625
                },
                {
                    "start": 232.03,
                    "end": 232.45,
                    "word": " discover",
                    "probability": 0.76708984375
                },
                {
                    "start": 232.45,
                    "end": 232.79,
                    "word": " more",
                    "probability": 0.8876953125
                },
                {
                    "start": 232.79,
                    "end": 233.13,
                    "word": " similar",
                    "probability": 0.91650390625
                },
                {
                    "start": 233.13,
                    "end": 233.67,
                    "word": " samples",
                    "probability": 0.6865234375
                },
                {
                    "start": 233.67,
                    "end": 234.45,
                    "word": ",",
                    "probability": 0.60107421875
                },
                {
                    "start": 234.45,
                    "end": 234.67,
                    "word": " which",
                    "probability": 0.919921875
                },
                {
                    "start": 234.67,
                    "end": 234.83,
                    "word": " can",
                    "probability": 0.89404296875
                },
                {
                    "start": 234.83,
                    "end": 234.99,
                    "word": " be",
                    "probability": 0.90283203125
                },
                {
                    "start": 234.99,
                    "end": 235.23,
                    "word": " linked",
                    "probability": 0.72216796875
                },
                {
                    "start": 235.23,
                    "end": 235.45,
                    "word": " to",
                    "probability": 0.853515625
                },
                {
                    "start": 235.45,
                    "end": 235.63,
                    "word": " the",
                    "probability": 0.80859375
                },
                {
                    "start": 235.63,
                    "end": 235.89,
                    "word": " same",
                    "probability": 0.8310546875
                },
                {
                    "start": 235.89,
                    "end": 236.27,
                    "word": " attacks",
                    "probability": 0.54443359375
                },
                {
                    "start": 236.27,
                    "end": 236.67,
                    "word": " or",
                    "probability": 0.8720703125
                },
                {
                    "start": 236.67,
                    "end": 237.05,
                    "word": " to",
                    "probability": 0.89306640625
                },
                {
                    "start": 237.05,
                    "end": 237.21,
                    "word": " the",
                    "probability": 0.81201171875
                },
                {
                    "start": 237.21,
                    "end": 237.43,
                    "word": " same",
                    "probability": 0.822265625
                },
                {
                    "start": 237.43,
                    "end": 237.67,
                    "word": " threat",
                    "probability": 0.52197265625
                },
                {
                    "start": 237.67,
                    "end": 238.03,
                    "word": " actors",
                    "probability": 0.81689453125
                },
                {
                    "start": 238.03,
                    "end": 238.67,
                    "word": ".",
                    "probability": 0.9853515625
                }
            ]
        },
        {
            "id": 67,
            "seek": 24764,
            "start": 239.71,
            "end": 241.33,
            "text": " And where to search?",
            "tokens": [
                51414,
                400,
                689,
                281,
                3164,
                30,
                51514
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2323638684678786,
            "compression_ratio": 1.6758893280632412,
            "no_speech_prob": 0.01348876953125,
            "words": [
                {
                    "start": 239.71,
                    "end": 240.05,
                    "word": " And",
                    "probability": 0.759765625
                },
                {
                    "start": 240.05,
                    "end": 240.23,
                    "word": " where",
                    "probability": 0.83740234375
                },
                {
                    "start": 240.23,
                    "end": 240.39,
                    "word": " to",
                    "probability": 0.90771484375
                },
                {
                    "start": 240.39,
                    "end": 240.71,
                    "word": " search",
                    "probability": 0.91650390625
                },
                {
                    "start": 240.71,
                    "end": 241.33,
                    "word": "?",
                    "probability": 0.8466796875
                }
            ]
        },
        {
            "id": 68,
            "seek": 24764,
            "start": 241.33,
            "end": 247.99,
            "text": " Here is a list of couple of examples, which will be covered later during this talk.",
            "tokens": [
                51514,
                1692,
                307,
                257,
                1329,
                295,
                1916,
                295,
                5110,
                11,
                597,
                486,
                312,
                5343,
                1780,
                1830,
                341,
                751,
                13,
                51814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2323638684678786,
            "compression_ratio": 1.6758893280632412,
            "no_speech_prob": 0.01348876953125,
            "words": [
                {
                    "start": 241.33,
                    "end": 241.83,
                    "word": " Here",
                    "probability": 0.81640625
                },
                {
                    "start": 241.83,
                    "end": 242.29,
                    "word": " is",
                    "probability": 0.87451171875
                },
                {
                    "start": 242.61,
                    "end": 242.87,
                    "word": " a list",
                    "probability": 0.8662109375
                },
                {
                    "start": 242.87,
                    "end": 243.07,
                    "word": " of",
                    "probability": 0.90673828125
                },
                {
                    "start": 243.07,
                    "end": 243.35,
                    "word": " couple",
                    "probability": 0.2318115234375
                },
                {
                    "start": 243.35,
                    "end": 243.53,
                    "word": " of",
                    "probability": 0.8876953125
                },
                {
                    "start": 243.53,
                    "end": 244.03,
                    "word": " examples",
                    "probability": 0.8037109375
                },
                {
                    "start": 244.03,
                    "end": 244.55,
                    "word": ",",
                    "probability": 0.62744140625
                },
                {
                    "start": 244.55,
                    "end": 244.73,
                    "word": " which",
                    "probability": 0.9169921875
                },
                {
                    "start": 244.73,
                    "end": 245.65,
                    "word": " will",
                    "probability": 0.75634765625
                },
                {
                    "start": 245.65,
                    "end": 245.83,
                    "word": " be",
                    "probability": 0.90771484375
                },
                {
                    "start": 245.83,
                    "end": 246.13,
                    "word": " covered",
                    "probability": 0.685546875
                },
                {
                    "start": 246.13,
                    "end": 246.47,
                    "word": " later",
                    "probability": 0.859375
                },
                {
                    "start": 246.47,
                    "end": 246.77,
                    "word": " during",
                    "probability": 0.79345703125
                },
                {
                    "start": 246.77,
                    "end": 247.03,
                    "word": " this",
                    "probability": 0.87451171875
                },
                {
                    "start": 247.03,
                    "end": 247.37,
                    "word": " talk",
                    "probability": 0.7822265625
                },
                {
                    "start": 247.37,
                    "end": 247.99,
                    "word": ".",
                    "probability": 0.63232421875
                }
            ]
        },
        {
            "id": 69,
            "seek": 27464,
            "start": 247.99,
            "end": 251.67,
            "text": " And also, some of these tools can be very handy for the analyst.",
            "tokens": [
                50364,
                400,
                611,
                11,
                512,
                295,
                613,
                3873,
                393,
                312,
                588,
                13239,
                337,
                264,
                19085,
                13,
                50564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.26742097564127254,
            "compression_ratio": 1.56,
            "no_speech_prob": 0.0159759521484375,
            "words": [
                {
                    "start": 247.99,
                    "end": 248.33,
                    "word": " And",
                    "probability": 0.305419921875
                },
                {
                    "start": 248.33,
                    "end": 248.79,
                    "word": " also",
                    "probability": 0.75390625
                },
                {
                    "start": 248.79,
                    "end": 248.99,
                    "word": ",",
                    "probability": 0.259765625
                },
                {
                    "start": 248.99,
                    "end": 249.07,
                    "word": " some",
                    "probability": 0.802734375
                },
                {
                    "start": 249.07,
                    "end": 249.23,
                    "word": " of",
                    "probability": 0.9033203125
                },
                {
                    "start": 249.23,
                    "end": 249.39,
                    "word": " these",
                    "probability": 0.68896484375
                },
                {
                    "start": 249.39,
                    "end": 249.65,
                    "word": " tools",
                    "probability": 0.7958984375
                },
                {
                    "start": 249.65,
                    "end": 249.85,
                    "word": " can",
                    "probability": 0.8955078125
                },
                {
                    "start": 249.85,
                    "end": 249.97,
                    "word": " be",
                    "probability": 0.9033203125
                },
                {
                    "start": 249.97,
                    "end": 250.21,
                    "word": " very",
                    "probability": 0.71484375
                },
                {
                    "start": 250.21,
                    "end": 250.45,
                    "word": " handy",
                    "probability": 0.76123046875
                },
                {
                    "start": 250.45,
                    "end": 250.71,
                    "word": " for",
                    "probability": 0.8955078125
                },
                {
                    "start": 250.71,
                    "end": 250.87,
                    "word": " the",
                    "probability": 0.79150390625
                },
                {
                    "start": 250.87,
                    "end": 251.23,
                    "word": " analyst",
                    "probability": 0.55224609375
                },
                {
                    "start": 251.23,
                    "end": 251.67,
                    "word": ".",
                    "probability": 0.54443359375
                }
            ]
        },
        {
            "id": 70,
            "seek": 27464,
            "start": 251.67,
            "end": 255.31,
            "text": " But these slides will be shared with you, so let's move forward.",
            "tokens": [
                50564,
                583,
                613,
                9788,
                486,
                312,
                5507,
                365,
                291,
                11,
                370,
                718,
                311,
                1286,
                2128,
                13,
                50764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.26742097564127254,
            "compression_ratio": 1.56,
            "no_speech_prob": 0.0159759521484375,
            "words": [
                {
                    "start": 251.67,
                    "end": 251.79,
                    "word": " But",
                    "probability": 0.8330078125
                },
                {
                    "start": 251.79,
                    "end": 251.97,
                    "word": " these",
                    "probability": 0.44775390625
                },
                {
                    "start": 251.97,
                    "end": 252.29,
                    "word": " slides",
                    "probability": 0.90380859375
                },
                {
                    "start": 252.29,
                    "end": 252.51,
                    "word": " will",
                    "probability": 0.79541015625
                },
                {
                    "start": 252.51,
                    "end": 252.71,
                    "word": " be",
                    "probability": 0.89892578125
                },
                {
                    "start": 252.71,
                    "end": 252.93,
                    "word": " shared",
                    "probability": 0.76025390625
                },
                {
                    "start": 252.93,
                    "end": 253.15,
                    "word": " with",
                    "probability": 0.81298828125
                },
                {
                    "start": 253.15,
                    "end": 253.39,
                    "word": " you",
                    "probability": 0.896484375
                },
                {
                    "start": 253.39,
                    "end": 253.77,
                    "word": ",",
                    "probability": 0.4521484375
                },
                {
                    "start": 253.77,
                    "end": 253.95,
                    "word": " so",
                    "probability": 0.896484375
                },
                {
                    "start": 253.95,
                    "end": 254.29,
                    "word": " let's",
                    "probability": 0.926513671875
                },
                {
                    "start": 254.29,
                    "end": 254.47,
                    "word": " move",
                    "probability": 0.87841796875
                },
                {
                    "start": 254.47,
                    "end": 254.71,
                    "word": " forward",
                    "probability": 0.54541015625
                },
                {
                    "start": 254.71,
                    "end": 255.31,
                    "word": ".",
                    "probability": 0.97119140625
                }
            ]
        },
        {
            "id": 71,
            "seek": 27464,
            "start": 255.83,
            "end": 262.65,
            "text": " And okay, now we are ready to start with advertised incident response and infection with coin miners.",
            "tokens": [
                50764,
                400,
                1392,
                11,
                586,
                321,
                366,
                1919,
                281,
                722,
                365,
                42310,
                9348,
                4134,
                293,
                11764,
                365,
                11464,
                35640,
                13,
                51164
            ],
            "temperature": 0.0,
            "avg_logprob": -0.26742097564127254,
            "compression_ratio": 1.56,
            "no_speech_prob": 0.0159759521484375,
            "words": [
                {
                    "start": 255.83,
                    "end": 256.13,
                    "word": " And",
                    "probability": 0.5205078125
                },
                {
                    "start": 256.13,
                    "end": 256.47,
                    "word": " okay",
                    "probability": 0.42529296875
                },
                {
                    "start": 256.47,
                    "end": 256.87,
                    "word": ",",
                    "probability": 0.6650390625
                },
                {
                    "start": 256.87,
                    "end": 257.31,
                    "word": " now",
                    "probability": 0.88818359375
                },
                {
                    "start": 257.31,
                    "end": 257.49,
                    "word": " we",
                    "probability": 0.7890625
                },
                {
                    "start": 257.49,
                    "end": 257.63,
                    "word": " are",
                    "probability": 0.8515625
                },
                {
                    "start": 257.63,
                    "end": 257.87,
                    "word": " ready",
                    "probability": 0.77392578125
                },
                {
                    "start": 257.87,
                    "end": 258.01,
                    "word": " to",
                    "probability": 0.90576171875
                },
                {
                    "start": 258.01,
                    "end": 258.37,
                    "word": " start",
                    "probability": 0.85986328125
                },
                {
                    "start": 258.37,
                    "end": 258.65,
                    "word": " with",
                    "probability": 0.78759765625
                },
                {
                    "start": 258.65,
                    "end": 259.21,
                    "word": " advertised",
                    "probability": 0.482421875
                },
                {
                    "start": 259.21,
                    "end": 260.07,
                    "word": " incident",
                    "probability": 0.8330078125
                },
                {
                    "start": 260.07,
                    "end": 260.57,
                    "word": " response",
                    "probability": 0.8583984375
                },
                {
                    "start": 260.57,
                    "end": 260.73,
                    "word": " and",
                    "probability": 0.80419921875
                },
                {
                    "start": 260.73,
                    "end": 261.25,
                    "word": " infection",
                    "probability": 0.673828125
                },
                {
                    "start": 261.25,
                    "end": 261.47,
                    "word": " with",
                    "probability": 0.78466796875
                },
                {
                    "start": 261.47,
                    "end": 261.69,
                    "word": " coin",
                    "probability": 0.5478515625
                },
                {
                    "start": 261.69,
                    "end": 262.05,
                    "word": " miners",
                    "probability": 0.89013671875
                },
                {
                    "start": 262.05,
                    "end": 262.65,
                    "word": ".",
                    "probability": 0.99365234375
                }
            ]
        },
        {
            "id": 72,
            "seek": 27464,
            "start": 263.99,
            "end": 269.39,
            "text": " So, it began with a high load of some computers.",
            "tokens": [
                51164,
                407,
                11,
                309,
                4283,
                365,
                257,
                1090,
                3677,
                295,
                512,
                10807,
                13,
                51414
            ],
            "temperature": 0.0,
            "avg_logprob": -0.26742097564127254,
            "compression_ratio": 1.56,
            "no_speech_prob": 0.0159759521484375,
            "words": [
                {
                    "start": 263.99,
                    "end": 264.51,
                    "word": " So",
                    "probability": 0.86767578125
                },
                {
                    "start": 264.51,
                    "end": 264.77,
                    "word": ",",
                    "probability": 0.58740234375
                },
                {
                    "start": 264.77,
                    "end": 264.95,
                    "word": " it",
                    "probability": 0.880859375
                },
                {
                    "start": 264.95,
                    "end": 265.47,
                    "word": " began",
                    "probability": 0.806640625
                },
                {
                    "start": 265.47,
                    "end": 266.27,
                    "word": " with",
                    "probability": 0.80517578125
                },
                {
                    "start": 266.79,
                    "end": 267.15,
                    "word": " a high",
                    "probability": 0.76953125
                },
                {
                    "start": 267.15,
                    "end": 267.49,
                    "word": " load",
                    "probability": 0.75439453125
                },
                {
                    "start": 267.49,
                    "end": 267.87,
                    "word": " of",
                    "probability": 0.88720703125
                },
                {
                    "start": 267.87,
                    "end": 268.25,
                    "word": " some",
                    "probability": 0.798828125
                },
                {
                    "start": 268.25,
                    "end": 268.91,
                    "word": " computers",
                    "probability": 0.77880859375
                },
                {
                    "start": 268.91,
                    "end": 269.39,
                    "word": ".",
                    "probability": 0.849609375
                }
            ]
        },
        {
            "id": 73,
            "seek": 27464,
            "start": 269.39,
            "end": 274.99,
            "text": " One could say, nothing strange, maybe only updates were being applied.",
            "tokens": [
                51414,
                1485,
                727,
                584,
                11,
                1825,
                5861,
                11,
                1310,
                787,
                9205,
                645,
                885,
                6456,
                13,
                51714
            ],
            "temperature": 0.0,
            "avg_logprob": -0.26742097564127254,
            "compression_ratio": 1.56,
            "no_speech_prob": 0.0159759521484375,
            "words": [
                {
                    "start": 269.39,
                    "end": 269.55,
                    "word": " One",
                    "probability": 0.89306640625
                },
                {
                    "start": 269.55,
                    "end": 269.73,
                    "word": " could",
                    "probability": 0.796875
                },
                {
                    "start": 269.73,
                    "end": 270.09,
                    "word": " say",
                    "probability": 0.89990234375
                },
                {
                    "start": 270.09,
                    "end": 270.39,
                    "word": ",",
                    "probability": 0.517578125
                },
                {
                    "start": 270.39,
                    "end": 270.59,
                    "word": " nothing",
                    "probability": 0.7841796875
                },
                {
                    "start": 270.59,
                    "end": 271.15,
                    "word": " strange",
                    "probability": 0.7666015625
                },
                {
                    "start": 271.15,
                    "end": 271.31,
                    "word": ",",
                    "probability": 0.599609375
                },
                {
                    "start": 271.31,
                    "end": 271.55,
                    "word": " maybe",
                    "probability": 0.859375
                },
                {
                    "start": 271.55,
                    "end": 272.11,
                    "word": " only",
                    "probability": 0.84619140625
                },
                {
                    "start": 272.11,
                    "end": 273.09,
                    "word": " updates",
                    "probability": 0.830078125
                },
                {
                    "start": 273.09,
                    "end": 273.41,
                    "word": " were",
                    "probability": 0.81982421875
                },
                {
                    "start": 273.41,
                    "end": 273.81,
                    "word": " being",
                    "probability": 0.87841796875
                },
                {
                    "start": 273.81,
                    "end": 274.39,
                    "word": " applied",
                    "probability": 0.69140625
                },
                {
                    "start": 274.39,
                    "end": 274.99,
                    "word": ".",
                    "probability": 0.83935546875
                }
            ]
        },
        {
            "id": 74,
            "seek": 30136,
            "start": 274.99,
            "end": 281.35,
            "text": " But when local IT guys verified these machines, they noticed something unusual.",
            "tokens": [
                50364,
                583,
                562,
                2654,
                6783,
                1074,
                31197,
                613,
                8379,
                11,
                436,
                5694,
                746,
                10901,
                13,
                50664
            ],
            "temperature": 0.0,
            "avg_logprob": -0.241386225208258,
            "compression_ratio": 1.5091743119266054,
            "no_speech_prob": 0.018646240234375,
            "words": [
                {
                    "start": 274.99,
                    "end": 275.33,
                    "word": " But",
                    "probability": 0.681640625
                },
                {
                    "start": 275.33,
                    "end": 275.57,
                    "word": " when",
                    "probability": 0.59619140625
                },
                {
                    "start": 275.57,
                    "end": 276.41,
                    "word": " local",
                    "probability": 0.6181640625
                },
                {
                    "start": 276.41,
                    "end": 276.79,
                    "word": " IT",
                    "probability": 0.84423828125
                },
                {
                    "start": 276.79,
                    "end": 277.17,
                    "word": " guys",
                    "probability": 0.84033203125
                },
                {
                    "start": 277.17,
                    "end": 277.75,
                    "word": " verified",
                    "probability": 0.88916015625
                },
                {
                    "start": 277.75,
                    "end": 278.09,
                    "word": " these",
                    "probability": 0.66650390625
                },
                {
                    "start": 278.09,
                    "end": 278.55,
                    "word": " machines",
                    "probability": 0.84375
                },
                {
                    "start": 278.55,
                    "end": 279.13,
                    "word": ",",
                    "probability": 0.84619140625
                },
                {
                    "start": 279.13,
                    "end": 279.37,
                    "word": " they",
                    "probability": 0.732421875
                },
                {
                    "start": 279.37,
                    "end": 279.79,
                    "word": " noticed",
                    "probability": 0.75439453125
                },
                {
                    "start": 279.79,
                    "end": 280.19,
                    "word": " something",
                    "probability": 0.748046875
                },
                {
                    "start": 280.19,
                    "end": 280.67,
                    "word": " unusual",
                    "probability": 0.8369140625
                },
                {
                    "start": 280.67,
                    "end": 281.35,
                    "word": ".",
                    "probability": 0.75048828125
                }
            ]
        },
        {
            "id": 75,
            "seek": 30136,
            "start": 281.35,
            "end": 285.83,
            "text": " Abnormally high CPU and memory usage by SVC host process.",
            "tokens": [
                50664,
                2847,
                13403,
                379,
                1090,
                13199,
                293,
                4675,
                14924,
                538,
                31910,
                34,
                3975,
                1399,
                13,
                50914
            ],
            "temperature": 0.0,
            "avg_logprob": -0.241386225208258,
            "compression_ratio": 1.5091743119266054,
            "no_speech_prob": 0.018646240234375,
            "words": [
                {
                    "start": 281.35,
                    "end": 281.83,
                    "word": " Abnormally",
                    "probability": 0.84423828125
                },
                {
                    "start": 281.83,
                    "end": 282.19,
                    "word": " high",
                    "probability": 0.8818359375
                },
                {
                    "start": 282.19,
                    "end": 282.61,
                    "word": " CPU",
                    "probability": 0.91943359375
                },
                {
                    "start": 282.61,
                    "end": 282.89,
                    "word": " and",
                    "probability": 0.88818359375
                },
                {
                    "start": 282.89,
                    "end": 283.17,
                    "word": " memory",
                    "probability": 0.81591796875
                },
                {
                    "start": 283.17,
                    "end": 283.57,
                    "word": " usage",
                    "probability": 0.8212890625
                },
                {
                    "start": 283.57,
                    "end": 284.17,
                    "word": " by",
                    "probability": 0.89111328125
                },
                {
                    "start": 284.17,
                    "end": 284.57,
                    "word": " SVC",
                    "probability": 0.6339111328125
                },
                {
                    "start": 284.57,
                    "end": 284.83,
                    "word": " host",
                    "probability": 0.79296875
                },
                {
                    "start": 284.83,
                    "end": 285.27,
                    "word": " process",
                    "probability": 0.8173828125
                },
                {
                    "start": 285.27,
                    "end": 285.83,
                    "word": ".",
                    "probability": 0.962890625
                }
            ]
        },
        {
            "id": 76,
            "seek": 30136,
            "start": 285.83,
            "end": 292.91,
            "text": " Moreover, the SVC host process corresponded with the problem reports and solution control panel support service.",
            "tokens": [
                50914,
                19838,
                11,
                264,
                31910,
                34,
                3975,
                1399,
                6805,
                292,
                365,
                264,
                1154,
                7122,
                293,
                3827,
                1969,
                4831,
                1406,
                2643,
                13,
                51264
            ],
            "temperature": 0.0,
            "avg_logprob": -0.241386225208258,
            "compression_ratio": 1.5091743119266054,
            "no_speech_prob": 0.018646240234375,
            "words": [
                {
                    "start": 285.83,
                    "end": 286.17,
                    "word": " Moreover",
                    "probability": 0.7763671875
                },
                {
                    "start": 286.17,
                    "end": 286.73,
                    "word": ",",
                    "probability": 0.9560546875
                },
                {
                    "start": 286.73,
                    "end": 286.85,
                    "word": " the",
                    "probability": 0.73291015625
                },
                {
                    "start": 286.85,
                    "end": 287.13,
                    "word": " SVC",
                    "probability": 0.89306640625
                },
                {
                    "start": 287.13,
                    "end": 287.41,
                    "word": " host",
                    "probability": 0.84619140625
                },
                {
                    "start": 287.41,
                    "end": 287.81,
                    "word": " process",
                    "probability": 0.86767578125
                },
                {
                    "start": 287.81,
                    "end": 288.43,
                    "word": " corresponded",
                    "probability": 0.834716796875
                },
                {
                    "start": 288.43,
                    "end": 288.63,
                    "word": " with",
                    "probability": 0.79638671875
                },
                {
                    "start": 288.63,
                    "end": 289.01,
                    "word": " the",
                    "probability": 0.8125
                },
                {
                    "start": 289.01,
                    "end": 289.71,
                    "word": " problem",
                    "probability": 0.60986328125
                },
                {
                    "start": 289.71,
                    "end": 290.21,
                    "word": " reports",
                    "probability": 0.75146484375
                },
                {
                    "start": 290.21,
                    "end": 290.43,
                    "word": " and",
                    "probability": 0.88134765625
                },
                {
                    "start": 290.43,
                    "end": 290.73,
                    "word": " solution",
                    "probability": 0.78466796875
                },
                {
                    "start": 290.73,
                    "end": 291.15,
                    "word": " control",
                    "probability": 0.7060546875
                },
                {
                    "start": 291.15,
                    "end": 291.41,
                    "word": " panel",
                    "probability": 0.771484375
                },
                {
                    "start": 291.41,
                    "end": 291.87,
                    "word": " support",
                    "probability": 0.865234375
                },
                {
                    "start": 291.87,
                    "end": 292.33,
                    "word": " service",
                    "probability": 0.68408203125
                },
                {
                    "start": 292.33,
                    "end": 292.91,
                    "word": ".",
                    "probability": 0.990234375
                }
            ]
        },
        {
            "id": 77,
            "seek": 30136,
            "start": 293.11,
            "end": 297.19,
            "text": " This could be a more serious problem, indeed.",
            "tokens": [
                51264,
                639,
                727,
                312,
                257,
                544,
                3156,
                1154,
                11,
                6451,
                13,
                51514
            ],
            "temperature": 0.0,
            "avg_logprob": -0.241386225208258,
            "compression_ratio": 1.5091743119266054,
            "no_speech_prob": 0.018646240234375,
            "words": [
                {
                    "start": 293.11,
                    "end": 293.91,
                    "word": " This",
                    "probability": 0.5302734375
                },
                {
                    "start": 293.91,
                    "end": 294.13,
                    "word": " could",
                    "probability": 0.8134765625
                },
                {
                    "start": 294.13,
                    "end": 294.39,
                    "word": " be",
                    "probability": 0.90576171875
                },
                {
                    "start": 294.61,
                    "end": 294.81,
                    "word": " a more",
                    "probability": 0.880859375
                },
                {
                    "start": 294.81,
                    "end": 295.13,
                    "word": " serious",
                    "probability": 0.82568359375
                },
                {
                    "start": 295.13,
                    "end": 295.71,
                    "word": " problem",
                    "probability": 0.76708984375
                },
                {
                    "start": 295.71,
                    "end": 296.01,
                    "word": ",",
                    "probability": 0.246826171875
                },
                {
                    "start": 296.01,
                    "end": 296.39,
                    "word": " indeed",
                    "probability": 0.67724609375
                },
                {
                    "start": 296.39,
                    "end": 297.19,
                    "word": ".",
                    "probability": 0.9765625
                }
            ]
        },
        {
            "id": 78,
            "seek": 30136,
            "start": 297.95,
            "end": 301.71,
            "text": " Antivirus did not find anything.",
            "tokens": [
                51514,
                5130,
                592,
                9619,
                630,
                406,
                915,
                1340,
                13,
                51714
            ],
            "temperature": 0.0,
            "avg_logprob": -0.241386225208258,
            "compression_ratio": 1.5091743119266054,
            "no_speech_prob": 0.018646240234375,
            "words": [
                {
                    "start": 297.95,
                    "end": 298.75,
                    "word": " Antivirus",
                    "probability": 0.9005533854166666
                },
                {
                    "start": 298.75,
                    "end": 299.91,
                    "word": " did",
                    "probability": 0.432373046875
                },
                {
                    "start": 299.91,
                    "end": 300.13,
                    "word": " not",
                    "probability": 0.9052734375
                },
                {
                    "start": 300.13,
                    "end": 300.53,
                    "word": " find",
                    "probability": 0.81591796875
                },
                {
                    "start": 300.53,
                    "end": 300.91,
                    "word": " anything",
                    "probability": 0.85791015625
                },
                {
                    "start": 300.91,
                    "end": 301.71,
                    "word": ".",
                    "probability": 0.63916015625
                }
            ]
        },
        {
            "id": 79,
            "seek": 32606,
            "start": 301.71,
            "end": 310.17,
            "text": " But after manual submission of DLLs, the antivirus company identified them as coin miner or crypto mining variant.",
            "tokens": [
                50364,
                583,
                934,
                9688,
                23689,
                295,
                413,
                24010,
                82,
                11,
                264,
                2511,
                592,
                9619,
                2237,
                9234,
                552,
                382,
                11464,
                18746,
                420,
                17240,
                15512,
                17501,
                13,
                50764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2086588537527455,
            "compression_ratio": 1.5458937198067633,
            "no_speech_prob": 0.016693115234375,
            "words": [
                {
                    "start": 301.71,
                    "end": 302.11,
                    "word": " But",
                    "probability": 0.5927734375
                },
                {
                    "start": 302.11,
                    "end": 302.43,
                    "word": " after",
                    "probability": 0.7197265625
                },
                {
                    "start": 302.43,
                    "end": 302.75,
                    "word": " manual",
                    "probability": 0.861328125
                },
                {
                    "start": 302.75,
                    "end": 303.27,
                    "word": " submission",
                    "probability": 0.8115234375
                },
                {
                    "start": 303.27,
                    "end": 303.87,
                    "word": " of",
                    "probability": 0.9013671875
                },
                {
                    "start": 303.87,
                    "end": 304.51,
                    "word": " DLLs",
                    "probability": 0.9029947916666666
                },
                {
                    "start": 304.51,
                    "end": 305.11,
                    "word": ",",
                    "probability": 0.791015625
                },
                {
                    "start": 305.11,
                    "end": 305.27,
                    "word": " the",
                    "probability": 0.8095703125
                },
                {
                    "start": 305.27,
                    "end": 305.67,
                    "word": " antivirus",
                    "probability": 0.8455403645833334
                },
                {
                    "start": 305.67,
                    "end": 306.07,
                    "word": " company",
                    "probability": 0.80126953125
                },
                {
                    "start": 306.07,
                    "end": 306.53,
                    "word": " identified",
                    "probability": 0.8955078125
                },
                {
                    "start": 306.53,
                    "end": 306.85,
                    "word": " them",
                    "probability": 0.7509765625
                },
                {
                    "start": 306.85,
                    "end": 307.21,
                    "word": " as",
                    "probability": 0.8974609375
                },
                {
                    "start": 307.21,
                    "end": 307.45,
                    "word": " coin",
                    "probability": 0.5419921875
                },
                {
                    "start": 307.45,
                    "end": 307.83,
                    "word": " miner",
                    "probability": 0.458251953125
                },
                {
                    "start": 307.83,
                    "end": 308.21,
                    "word": " or",
                    "probability": 0.86962890625
                },
                {
                    "start": 308.21,
                    "end": 308.61,
                    "word": " crypto",
                    "probability": 0.63916015625
                },
                {
                    "start": 308.61,
                    "end": 308.93,
                    "word": " mining",
                    "probability": 0.7607421875
                },
                {
                    "start": 308.93,
                    "end": 309.45,
                    "word": " variant",
                    "probability": 0.6259765625
                },
                {
                    "start": 309.45,
                    "end": 310.17,
                    "word": ".",
                    "probability": 0.94482421875
                }
            ]
        },
        {
            "id": 80,
            "seek": 32606,
            "start": 310.17,
            "end": 313.63,
            "text": " So, that's how the incident response began.",
            "tokens": [
                50764,
                407,
                11,
                300,
                311,
                577,
                264,
                9348,
                4134,
                4283,
                13,
                50964
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2086588537527455,
            "compression_ratio": 1.5458937198067633,
            "no_speech_prob": 0.016693115234375,
            "words": [
                {
                    "start": 310.17,
                    "end": 310.35,
                    "word": " So",
                    "probability": 0.74072265625
                },
                {
                    "start": 310.35,
                    "end": 310.65,
                    "word": ",",
                    "probability": 0.35009765625
                },
                {
                    "start": 310.65,
                    "end": 311.03,
                    "word": " that's",
                    "probability": 0.897216796875
                },
                {
                    "start": 311.03,
                    "end": 311.41,
                    "word": " how",
                    "probability": 0.89453125
                },
                {
                    "start": 311.41,
                    "end": 311.77,
                    "word": " the",
                    "probability": 0.81298828125
                },
                {
                    "start": 311.77,
                    "end": 312.03,
                    "word": " incident",
                    "probability": 0.90283203125
                },
                {
                    "start": 312.03,
                    "end": 312.53,
                    "word": " response",
                    "probability": 0.908203125
                },
                {
                    "start": 312.53,
                    "end": 312.87,
                    "word": " began",
                    "probability": 0.81201171875
                },
                {
                    "start": 312.87,
                    "end": 313.63,
                    "word": ".",
                    "probability": 0.97021484375
                }
            ]
        },
        {
            "id": 81,
            "seek": 32606,
            "start": 314.73,
            "end": 321.01,
            "text": " We verified the findings of our client and we started analyzing machine with the coin miner.",
            "tokens": [
                50964,
                492,
                31197,
                264,
                16483,
                295,
                527,
                6423,
                293,
                321,
                1409,
                23663,
                3479,
                365,
                264,
                11464,
                18746,
                13,
                51314
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2086588537527455,
            "compression_ratio": 1.5458937198067633,
            "no_speech_prob": 0.016693115234375,
            "words": [
                {
                    "start": 314.73,
                    "end": 315.49,
                    "word": " We",
                    "probability": 0.9013671875
                },
                {
                    "start": 315.49,
                    "end": 316.05,
                    "word": " verified",
                    "probability": 0.91552734375
                },
                {
                    "start": 316.05,
                    "end": 316.43,
                    "word": " the",
                    "probability": 0.8115234375
                },
                {
                    "start": 316.43,
                    "end": 316.81,
                    "word": " findings",
                    "probability": 0.81201171875
                },
                {
                    "start": 316.81,
                    "end": 317.01,
                    "word": " of",
                    "probability": 0.90673828125
                },
                {
                    "start": 317.01,
                    "end": 317.25,
                    "word": " our",
                    "probability": 0.81298828125
                },
                {
                    "start": 317.25,
                    "end": 317.71,
                    "word": " client",
                    "probability": 0.87939453125
                },
                {
                    "start": 317.71,
                    "end": 318.25,
                    "word": " and",
                    "probability": 0.61181640625
                },
                {
                    "start": 318.25,
                    "end": 318.41,
                    "word": " we",
                    "probability": 0.857421875
                },
                {
                    "start": 318.41,
                    "end": 318.77,
                    "word": " started",
                    "probability": 0.80810546875
                },
                {
                    "start": 318.77,
                    "end": 319.31,
                    "word": " analyzing",
                    "probability": 0.5498046875
                },
                {
                    "start": 319.31,
                    "end": 319.75,
                    "word": " machine",
                    "probability": 0.50048828125
                },
                {
                    "start": 319.75,
                    "end": 319.99,
                    "word": " with",
                    "probability": 0.8076171875
                },
                {
                    "start": 319.99,
                    "end": 320.17,
                    "word": " the",
                    "probability": 0.78955078125
                },
                {
                    "start": 320.17,
                    "end": 320.33,
                    "word": " coin",
                    "probability": 0.8271484375
                },
                {
                    "start": 320.33,
                    "end": 320.63,
                    "word": " miner",
                    "probability": 0.658203125
                },
                {
                    "start": 320.63,
                    "end": 321.01,
                    "word": ".",
                    "probability": 0.97412109375
                }
            ]
        },
        {
            "id": 82,
            "seek": 32606,
            "start": 321.35,
            "end": 326.41,
            "text": " We followed the usual procedures and examined the provided evidence.",
            "tokens": [
                51314,
                492,
                6263,
                264,
                7713,
                13846,
                293,
                30972,
                264,
                5649,
                4467,
                13,
                51564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2086588537527455,
            "compression_ratio": 1.5458937198067633,
            "no_speech_prob": 0.016693115234375,
            "words": [
                {
                    "start": 321.35,
                    "end": 321.59,
                    "word": " We",
                    "probability": 0.875
                },
                {
                    "start": 321.59,
                    "end": 321.83,
                    "word": " followed",
                    "probability": 0.81005859375
                },
                {
                    "start": 321.83,
                    "end": 322.07,
                    "word": " the",
                    "probability": 0.74365234375
                },
                {
                    "start": 322.07,
                    "end": 322.47,
                    "word": " usual",
                    "probability": 0.875
                },
                {
                    "start": 322.47,
                    "end": 323.47,
                    "word": " procedures",
                    "probability": 0.7314453125
                },
                {
                    "start": 323.47,
                    "end": 324.41,
                    "word": " and",
                    "probability": 0.8583984375
                },
                {
                    "start": 324.41,
                    "end": 324.87,
                    "word": " examined",
                    "probability": 0.833984375
                },
                {
                    "start": 324.87,
                    "end": 325.13,
                    "word": " the",
                    "probability": 0.80908203125
                },
                {
                    "start": 325.13,
                    "end": 325.43,
                    "word": " provided",
                    "probability": 0.73486328125
                },
                {
                    "start": 325.43,
                    "end": 325.95,
                    "word": " evidence",
                    "probability": 0.90087890625
                },
                {
                    "start": 325.95,
                    "end": 326.41,
                    "word": ".",
                    "probability": 0.98388671875
                }
            ]
        },
        {
            "id": 83,
            "seek": 35294,
            "start": 326.41,
            "end": 336.85,
            "text": " We also verified signatures of DLLs in Windows System 32 directory and we checked those files against the National Software Reference Library database.",
            "tokens": [
                50364,
                492,
                611,
                31197,
                32322,
                295,
                413,
                24010,
                82,
                294,
                8591,
                8910,
                8858,
                21120,
                293,
                321,
                10033,
                729,
                7098,
                1970,
                264,
                4862,
                27428,
                1300,
                5158,
                12806,
                8149,
                13,
                50864
            ],
            "temperature": 0.0,
            "avg_logprob": -0.31350159148375195,
            "compression_ratio": 1.4279475982532752,
            "no_speech_prob": 0.301513671875,
            "words": [
                {
                    "start": 326.41,
                    "end": 326.59,
                    "word": " We",
                    "probability": 0.368896484375
                },
                {
                    "start": 326.59,
                    "end": 326.89,
                    "word": " also",
                    "probability": 0.79736328125
                },
                {
                    "start": 326.89,
                    "end": 327.31,
                    "word": " verified",
                    "probability": 0.82666015625
                },
                {
                    "start": 327.31,
                    "end": 327.81,
                    "word": " signatures",
                    "probability": 0.80322265625
                },
                {
                    "start": 327.81,
                    "end": 328.23,
                    "word": " of",
                    "probability": 0.8837890625
                },
                {
                    "start": 328.23,
                    "end": 328.85,
                    "word": " DLLs",
                    "probability": 0.93212890625
                },
                {
                    "start": 328.85,
                    "end": 329.51,
                    "word": " in",
                    "probability": 0.88330078125
                },
                {
                    "start": 329.51,
                    "end": 329.89,
                    "word": " Windows",
                    "probability": 0.3115234375
                },
                {
                    "start": 329.89,
                    "end": 330.19,
                    "word": " System",
                    "probability": 0.67724609375
                },
                {
                    "start": 330.19,
                    "end": 330.59,
                    "word": " 32",
                    "probability": 0.72021484375
                },
                {
                    "start": 330.59,
                    "end": 331.11,
                    "word": " directory",
                    "probability": 0.68115234375
                },
                {
                    "start": 331.11,
                    "end": 331.67,
                    "word": " and",
                    "probability": 0.650390625
                },
                {
                    "start": 331.67,
                    "end": 331.95,
                    "word": " we",
                    "probability": 0.8701171875
                },
                {
                    "start": 331.95,
                    "end": 332.21,
                    "word": " checked",
                    "probability": 0.705078125
                },
                {
                    "start": 332.21,
                    "end": 332.51,
                    "word": " those",
                    "probability": 0.796875
                },
                {
                    "start": 332.51,
                    "end": 332.83,
                    "word": " files",
                    "probability": 0.81494140625
                },
                {
                    "start": 332.83,
                    "end": 333.33,
                    "word": " against",
                    "probability": 0.88134765625
                },
                {
                    "start": 333.33,
                    "end": 333.85,
                    "word": " the",
                    "probability": 0.796875
                },
                {
                    "start": 333.85,
                    "end": 334.55,
                    "word": " National",
                    "probability": 0.5419921875
                },
                {
                    "start": 334.55,
                    "end": 334.97,
                    "word": " Software",
                    "probability": 0.869140625
                },
                {
                    "start": 334.97,
                    "end": 335.43,
                    "word": " Reference",
                    "probability": 0.830322265625
                },
                {
                    "start": 335.43,
                    "end": 335.77,
                    "word": " Library",
                    "probability": 0.71337890625
                },
                {
                    "start": 335.77,
                    "end": 336.37,
                    "word": " database",
                    "probability": 0.64306640625
                },
                {
                    "start": 336.37,
                    "end": 336.85,
                    "word": ".",
                    "probability": 0.98388671875
                }
            ]
        },
        {
            "id": 84,
            "seek": 35294,
            "start": 336.85,
            "end": 340.79,
            "text": " As a result, we found a couple of malicious files.",
            "tokens": [
                50864,
                1018,
                257,
                1874,
                11,
                321,
                1352,
                257,
                1916,
                295,
                33496,
                7098,
                13,
                51064
            ],
            "temperature": 0.0,
            "avg_logprob": -0.31350159148375195,
            "compression_ratio": 1.4279475982532752,
            "no_speech_prob": 0.301513671875,
            "words": [
                {
                    "start": 336.85,
                    "end": 337.05,
                    "word": " As",
                    "probability": 0.90185546875
                },
                {
                    "start": 337.19,
                    "end": 337.55,
                    "word": " a result",
                    "probability": 0.80908203125
                },
                {
                    "start": 337.55,
                    "end": 337.97,
                    "word": ",",
                    "probability": 0.8603515625
                },
                {
                    "start": 337.97,
                    "end": 338.13,
                    "word": " we",
                    "probability": 0.90234375
                },
                {
                    "start": 338.13,
                    "end": 338.45,
                    "word": " found",
                    "probability": 0.87451171875
                },
                {
                    "start": 338.93,
                    "end": 339.11,
                    "word": " a couple",
                    "probability": 0.78857421875
                },
                {
                    "start": 339.11,
                    "end": 339.45,
                    "word": " of",
                    "probability": 0.8916015625
                },
                {
                    "start": 339.45,
                    "end": 339.75,
                    "word": " malicious",
                    "probability": 0.814453125
                },
                {
                    "start": 339.75,
                    "end": 340.35,
                    "word": " files",
                    "probability": 0.78125
                },
                {
                    "start": 340.35,
                    "end": 340.79,
                    "word": ".",
                    "probability": 0.403076171875
                }
            ]
        },
        {
            "id": 85,
            "seek": 35294,
            "start": 340.79,
            "end": 353.29,
            "text": " For example, this unknown file where CPL support E-DLL, which tries to mimics the legitimate one file name without E suffix.",
            "tokens": [
                51064,
                1171,
                1365,
                11,
                341,
                9841,
                3991,
                689,
                383,
                21593,
                1406,
                462,
                12,
                35,
                24010,
                11,
                597,
                9898,
                281,
                2752,
                76,
                1167,
                264,
                17956,
                472,
                3991,
                1315,
                1553,
                462,
                3889,
                970,
                13,
                51664
            ],
            "temperature": 0.0,
            "avg_logprob": -0.31350159148375195,
            "compression_ratio": 1.4279475982532752,
            "no_speech_prob": 0.301513671875,
            "words": [
                {
                    "start": 340.79,
                    "end": 340.93,
                    "word": " For",
                    "probability": 0.90380859375
                },
                {
                    "start": 340.93,
                    "end": 341.35,
                    "word": " example",
                    "probability": 0.931640625
                },
                {
                    "start": 341.35,
                    "end": 341.75,
                    "word": ",",
                    "probability": 0.94287109375
                },
                {
                    "start": 341.75,
                    "end": 341.99,
                    "word": " this",
                    "probability": 0.84228515625
                },
                {
                    "start": 341.99,
                    "end": 342.41,
                    "word": " unknown",
                    "probability": 0.6611328125
                },
                {
                    "start": 342.41,
                    "end": 342.95,
                    "word": " file",
                    "probability": 0.8154296875
                },
                {
                    "start": 342.95,
                    "end": 343.47,
                    "word": " where",
                    "probability": 0.321533203125
                },
                {
                    "start": 343.47,
                    "end": 343.97,
                    "word": " CPL",
                    "probability": 0.6510009765625
                },
                {
                    "start": 343.97,
                    "end": 344.45,
                    "word": " support",
                    "probability": 0.63427734375
                },
                {
                    "start": 344.45,
                    "end": 344.79,
                    "word": " E",
                    "probability": 0.470947265625
                },
                {
                    "start": 344.79,
                    "end": 345.35,
                    "word": "-DLL",
                    "probability": 0.7657063802083334
                },
                {
                    "start": 345.35,
                    "end": 346.01,
                    "word": ",",
                    "probability": 0.4287109375
                },
                {
                    "start": 346.01,
                    "end": 346.19,
                    "word": " which",
                    "probability": 0.9306640625
                },
                {
                    "start": 346.19,
                    "end": 346.67,
                    "word": " tries",
                    "probability": 0.445068359375
                },
                {
                    "start": 346.67,
                    "end": 347.05,
                    "word": " to",
                    "probability": 0.90234375
                },
                {
                    "start": 347.05,
                    "end": 347.55,
                    "word": " mimics",
                    "probability": 0.5480143229166666
                },
                {
                    "start": 347.55,
                    "end": 348.29,
                    "word": " the",
                    "probability": 0.79833984375
                },
                {
                    "start": 348.29,
                    "end": 348.73,
                    "word": " legitimate",
                    "probability": 0.85546875
                },
                {
                    "start": 348.73,
                    "end": 349.23,
                    "word": " one",
                    "probability": 0.642578125
                },
                {
                    "start": 349.23,
                    "end": 350.25,
                    "word": " file",
                    "probability": 0.332763671875
                },
                {
                    "start": 350.25,
                    "end": 350.61,
                    "word": " name",
                    "probability": 0.736328125
                },
                {
                    "start": 350.61,
                    "end": 351.19,
                    "word": " without",
                    "probability": 0.775390625
                },
                {
                    "start": 351.19,
                    "end": 351.89,
                    "word": " E",
                    "probability": 0.86865234375
                },
                {
                    "start": 351.89,
                    "end": 352.45,
                    "word": " suffix",
                    "probability": 0.936279296875
                },
                {
                    "start": 352.45,
                    "end": 353.29,
                    "word": ".",
                    "probability": 0.9970703125
                }
            ]
        },
        {
            "id": 86,
            "seek": 37354,
            "start": 355.21,
            "end": 362.51,
            "text": " On the infected systems, there were a couple of DLLs marked as wannabe Windows System DLL files.",
            "tokens": [
                50414,
                1282,
                264,
                15414,
                3652,
                11,
                456,
                645,
                257,
                1916,
                295,
                413,
                24010,
                82,
                12658,
                382,
                38064,
                4488,
                8591,
                8910,
                413,
                24010,
                7098,
                13,
                50764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2722252021575796,
            "compression_ratio": 1.50920245398773,
            "no_speech_prob": 0.043182373046875,
            "words": [
                {
                    "start": 355.21,
                    "end": 355.93,
                    "word": " On",
                    "probability": 0.66064453125
                },
                {
                    "start": 355.93,
                    "end": 356.11,
                    "word": " the",
                    "probability": 0.78955078125
                },
                {
                    "start": 356.11,
                    "end": 356.43,
                    "word": " infected",
                    "probability": 0.5234375
                },
                {
                    "start": 356.43,
                    "end": 357.01,
                    "word": " systems",
                    "probability": 0.767578125
                },
                {
                    "start": 357.01,
                    "end": 357.49,
                    "word": ",",
                    "probability": 0.65576171875
                },
                {
                    "start": 357.49,
                    "end": 357.57,
                    "word": " there",
                    "probability": 0.85595703125
                },
                {
                    "start": 357.57,
                    "end": 357.79,
                    "word": " were",
                    "probability": 0.82763671875
                },
                {
                    "start": 357.91,
                    "end": 358.11,
                    "word": " a couple",
                    "probability": 0.783203125
                },
                {
                    "start": 358.11,
                    "end": 358.35,
                    "word": " of",
                    "probability": 0.8984375
                },
                {
                    "start": 358.35,
                    "end": 358.97,
                    "word": " DLLs",
                    "probability": 0.9117838541666666
                },
                {
                    "start": 358.97,
                    "end": 359.37,
                    "word": " marked",
                    "probability": 0.357177734375
                },
                {
                    "start": 359.37,
                    "end": 359.73,
                    "word": " as",
                    "probability": 0.904296875
                },
                {
                    "start": 359.73,
                    "end": 360.49,
                    "word": " wannabe",
                    "probability": 0.59356689453125
                },
                {
                    "start": 360.49,
                    "end": 360.87,
                    "word": " Windows",
                    "probability": 0.626953125
                },
                {
                    "start": 360.87,
                    "end": 361.19,
                    "word": " System",
                    "probability": 0.219970703125
                },
                {
                    "start": 361.19,
                    "end": 361.51,
                    "word": " DLL",
                    "probability": 0.95751953125
                },
                {
                    "start": 361.51,
                    "end": 362.01,
                    "word": " files",
                    "probability": 0.6904296875
                },
                {
                    "start": 362.01,
                    "end": 362.51,
                    "word": ".",
                    "probability": 0.4921875
                }
            ]
        },
        {
            "id": 87,
            "seek": 37354,
            "start": 362.51,
            "end": 373.89,
            "text": " But their hashes and also their file names were not present in any databases of known software and also in clean Windows systems they were not found.",
            "tokens": [
                50764,
                583,
                641,
                575,
                8076,
                293,
                611,
                641,
                3991,
                5288,
                645,
                406,
                1974,
                294,
                604,
                22380,
                295,
                2570,
                4722,
                293,
                611,
                294,
                2541,
                8591,
                3652,
                436,
                645,
                406,
                1352,
                13,
                51364
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2722252021575796,
            "compression_ratio": 1.50920245398773,
            "no_speech_prob": 0.043182373046875,
            "words": [
                {
                    "start": 362.51,
                    "end": 362.75,
                    "word": " But",
                    "probability": 0.86962890625
                },
                {
                    "start": 362.75,
                    "end": 363.01,
                    "word": " their",
                    "probability": 0.8642578125
                },
                {
                    "start": 363.01,
                    "end": 363.37,
                    "word": " hashes",
                    "probability": 0.89404296875
                },
                {
                    "start": 363.37,
                    "end": 363.67,
                    "word": " and",
                    "probability": 0.73046875
                },
                {
                    "start": 363.67,
                    "end": 363.93,
                    "word": " also",
                    "probability": 0.79248046875
                },
                {
                    "start": 363.93,
                    "end": 364.13,
                    "word": " their",
                    "probability": 0.8876953125
                },
                {
                    "start": 364.13,
                    "end": 364.43,
                    "word": " file",
                    "probability": 0.501953125
                },
                {
                    "start": 364.43,
                    "end": 364.73,
                    "word": " names",
                    "probability": 0.76904296875
                },
                {
                    "start": 364.73,
                    "end": 365.33,
                    "word": " were",
                    "probability": 0.82861328125
                },
                {
                    "start": 365.33,
                    "end": 365.59,
                    "word": " not",
                    "probability": 0.89501953125
                },
                {
                    "start": 365.59,
                    "end": 366.03,
                    "word": " present",
                    "probability": 0.767578125
                },
                {
                    "start": 366.03,
                    "end": 366.45,
                    "word": " in",
                    "probability": 0.89892578125
                },
                {
                    "start": 366.45,
                    "end": 366.71,
                    "word": " any",
                    "probability": 0.8369140625
                },
                {
                    "start": 366.71,
                    "end": 367.21,
                    "word": " databases",
                    "probability": 0.87890625
                },
                {
                    "start": 367.21,
                    "end": 367.51,
                    "word": " of",
                    "probability": 0.8935546875
                },
                {
                    "start": 367.51,
                    "end": 367.71,
                    "word": " known",
                    "probability": 0.69482421875
                },
                {
                    "start": 367.71,
                    "end": 368.13,
                    "word": " software",
                    "probability": 0.84130859375
                },
                {
                    "start": 368.13,
                    "end": 369.17,
                    "word": " and",
                    "probability": 0.448974609375
                },
                {
                    "start": 369.17,
                    "end": 369.57,
                    "word": " also",
                    "probability": 0.81640625
                },
                {
                    "start": 369.57,
                    "end": 370.11,
                    "word": " in",
                    "probability": 0.8759765625
                },
                {
                    "start": 370.11,
                    "end": 371.51,
                    "word": " clean",
                    "probability": 0.77978515625
                },
                {
                    "start": 371.51,
                    "end": 371.89,
                    "word": " Windows",
                    "probability": 0.7626953125
                },
                {
                    "start": 371.89,
                    "end": 372.35,
                    "word": " systems",
                    "probability": 0.65869140625
                },
                {
                    "start": 372.35,
                    "end": 372.75,
                    "word": " they",
                    "probability": 0.382080078125
                },
                {
                    "start": 372.75,
                    "end": 372.91,
                    "word": " were",
                    "probability": 0.88525390625
                },
                {
                    "start": 372.91,
                    "end": 373.09,
                    "word": " not",
                    "probability": 0.8994140625
                },
                {
                    "start": 373.09,
                    "end": 373.41,
                    "word": " found",
                    "probability": 0.89208984375
                },
                {
                    "start": 373.41,
                    "end": 373.89,
                    "word": ".",
                    "probability": 0.98876953125
                }
            ]
        },
        {
            "id": 88,
            "seek": 39392,
            "start": 373.89,
            "end": 386.87,
            "text": " In addition, we saw that the extracted strings contained many occurrences of xamarin substrings, so we had to deal with infection of xamarin-based coin miner.",
            "tokens": [
                50364,
                682,
                4500,
                11,
                321,
                1866,
                300,
                264,
                34086,
                13985,
                16212,
                867,
                5160,
                38983,
                295,
                2031,
                335,
                19829,
                4594,
                25782,
                11,
                370,
                321,
                632,
                281,
                2028,
                365,
                11764,
                295,
                2031,
                335,
                19829,
                12,
                6032,
                11464,
                18746,
                13,
                51064
            ],
            "temperature": 0.0,
            "avg_logprob": -0.26562498864673434,
            "compression_ratio": 1.5483870967741935,
            "no_speech_prob": 0.13330078125,
            "words": [
                {
                    "start": 373.89,
                    "end": 374.05,
                    "word": " In",
                    "probability": 0.67236328125
                },
                {
                    "start": 374.05,
                    "end": 374.41,
                    "word": " addition",
                    "probability": 0.91015625
                },
                {
                    "start": 374.41,
                    "end": 375.39,
                    "word": ",",
                    "probability": 0.9228515625
                },
                {
                    "start": 375.39,
                    "end": 375.57,
                    "word": " we",
                    "probability": 0.8828125
                },
                {
                    "start": 375.57,
                    "end": 375.87,
                    "word": " saw",
                    "probability": 0.82421875
                },
                {
                    "start": 375.87,
                    "end": 376.31,
                    "word": " that",
                    "probability": 0.8447265625
                },
                {
                    "start": 376.31,
                    "end": 376.47,
                    "word": " the",
                    "probability": 0.80419921875
                },
                {
                    "start": 376.47,
                    "end": 376.81,
                    "word": " extracted",
                    "probability": 0.71435546875
                },
                {
                    "start": 376.81,
                    "end": 377.27,
                    "word": " strings",
                    "probability": 0.8134765625
                },
                {
                    "start": 377.27,
                    "end": 377.83,
                    "word": " contained",
                    "probability": 0.72265625
                },
                {
                    "start": 377.83,
                    "end": 378.11,
                    "word": " many",
                    "probability": 0.7705078125
                },
                {
                    "start": 378.11,
                    "end": 378.61,
                    "word": " occurrences",
                    "probability": 0.80322265625
                },
                {
                    "start": 378.61,
                    "end": 379.17,
                    "word": " of",
                    "probability": 0.90576171875
                },
                {
                    "start": 379.17,
                    "end": 379.69,
                    "word": " xamarin",
                    "probability": 0.616455078125
                },
                {
                    "start": 379.69,
                    "end": 380.73,
                    "word": " substrings",
                    "probability": 0.6953125
                },
                {
                    "start": 380.73,
                    "end": 381.45,
                    "word": ",",
                    "probability": 0.479248046875
                },
                {
                    "start": 381.45,
                    "end": 381.65,
                    "word": " so",
                    "probability": 0.88818359375
                },
                {
                    "start": 381.65,
                    "end": 381.81,
                    "word": " we",
                    "probability": 0.89453125
                },
                {
                    "start": 381.81,
                    "end": 381.97,
                    "word": " had",
                    "probability": 0.75927734375
                },
                {
                    "start": 381.97,
                    "end": 382.13,
                    "word": " to",
                    "probability": 0.90283203125
                },
                {
                    "start": 382.13,
                    "end": 382.41,
                    "word": " deal",
                    "probability": 0.92529296875
                },
                {
                    "start": 382.41,
                    "end": 382.83,
                    "word": " with",
                    "probability": 0.81640625
                },
                {
                    "start": 382.83,
                    "end": 383.55,
                    "word": " infection",
                    "probability": 0.40087890625
                },
                {
                    "start": 383.55,
                    "end": 384.03,
                    "word": " of",
                    "probability": 0.90087890625
                },
                {
                    "start": 384.03,
                    "end": 384.51,
                    "word": " xamarin",
                    "probability": 0.8732096354166666
                },
                {
                    "start": 384.51,
                    "end": 385.03,
                    "word": "-based",
                    "probability": 0.8583984375
                },
                {
                    "start": 385.03,
                    "end": 385.87,
                    "word": " coin",
                    "probability": 0.50830078125
                },
                {
                    "start": 385.87,
                    "end": 386.15,
                    "word": " miner",
                    "probability": 0.2203369140625
                },
                {
                    "start": 386.15,
                    "end": 386.87,
                    "word": ".",
                    "probability": 0.98193359375
                }
            ]
        },
        {
            "id": 89,
            "seek": 39392,
            "start": 387.97,
            "end": 394.27,
            "text": " And there is another thing common for all of these xamarin-based coin miner DLLs.",
            "tokens": [
                51064,
                400,
                456,
                307,
                1071,
                551,
                2689,
                337,
                439,
                295,
                613,
                2031,
                335,
                19829,
                12,
                6032,
                11464,
                18746,
                413,
                24010,
                82,
                13,
                51414
            ],
            "temperature": 0.0,
            "avg_logprob": -0.26562498864673434,
            "compression_ratio": 1.5483870967741935,
            "no_speech_prob": 0.13330078125,
            "words": [
                {
                    "start": 387.97,
                    "end": 388.69,
                    "word": " And",
                    "probability": 0.5361328125
                },
                {
                    "start": 388.69,
                    "end": 388.87,
                    "word": " there",
                    "probability": 0.837890625
                },
                {
                    "start": 388.87,
                    "end": 389.09,
                    "word": " is",
                    "probability": 0.8818359375
                },
                {
                    "start": 389.09,
                    "end": 389.41,
                    "word": " another",
                    "probability": 0.8291015625
                },
                {
                    "start": 389.41,
                    "end": 390.01,
                    "word": " thing",
                    "probability": 0.7060546875
                },
                {
                    "start": 390.01,
                    "end": 390.35,
                    "word": " common",
                    "probability": 0.71435546875
                },
                {
                    "start": 390.35,
                    "end": 390.59,
                    "word": " for",
                    "probability": 0.890625
                },
                {
                    "start": 390.59,
                    "end": 390.89,
                    "word": " all",
                    "probability": 0.89111328125
                },
                {
                    "start": 390.89,
                    "end": 391.09,
                    "word": " of",
                    "probability": 0.73828125
                },
                {
                    "start": 391.09,
                    "end": 391.39,
                    "word": " these",
                    "probability": 0.6845703125
                },
                {
                    "start": 391.39,
                    "end": 391.83,
                    "word": " xamarin",
                    "probability": 0.9549153645833334
                },
                {
                    "start": 391.83,
                    "end": 392.27,
                    "word": "-based",
                    "probability": 0.911865234375
                },
                {
                    "start": 392.27,
                    "end": 392.57,
                    "word": " coin",
                    "probability": 0.705078125
                },
                {
                    "start": 392.57,
                    "end": 392.87,
                    "word": " miner",
                    "probability": 0.5693359375
                },
                {
                    "start": 392.87,
                    "end": 393.55,
                    "word": " DLLs",
                    "probability": 0.9578450520833334
                },
                {
                    "start": 393.55,
                    "end": 394.27,
                    "word": ".",
                    "probability": 0.9365234375
                }
            ]
        },
        {
            "id": 90,
            "seek": 41780,
            "start": 394.27,
            "end": 405.63,
            "text": " They created a mutex called samplexn07 and this mutex ensures that only one instance of coin miner is running on each infected device.",
            "tokens": [
                50364,
                814,
                2942,
                257,
                24523,
                87,
                1219,
                6889,
                87,
                77,
                16231,
                293,
                341,
                24523,
                87,
                28111,
                300,
                787,
                472,
                5197,
                295,
                11464,
                18746,
                307,
                2614,
                322,
                1184,
                15414,
                4302,
                13,
                50914
            ],
            "temperature": 0.0,
            "avg_logprob": -0.25367646445246306,
            "compression_ratio": 1.578125,
            "no_speech_prob": 0.188720703125,
            "words": [
                {
                    "start": 394.27,
                    "end": 395.07,
                    "word": " They",
                    "probability": 0.4140625
                },
                {
                    "start": 395.07,
                    "end": 395.53,
                    "word": " created",
                    "probability": 0.71630859375
                },
                {
                    "start": 395.77,
                    "end": 396.11,
                    "word": " a mutex",
                    "probability": 0.6258544921875
                },
                {
                    "start": 396.11,
                    "end": 396.47,
                    "word": " called",
                    "probability": 0.76318359375
                },
                {
                    "start": 396.47,
                    "end": 398.35,
                    "word": " samplexn07",
                    "probability": 0.5819091796875
                },
                {
                    "start": 398.35,
                    "end": 399.47,
                    "word": " and",
                    "probability": 0.292724609375
                },
                {
                    "start": 399.47,
                    "end": 399.79,
                    "word": " this",
                    "probability": 0.8017578125
                },
                {
                    "start": 399.79,
                    "end": 400.17,
                    "word": " mutex",
                    "probability": 0.852294921875
                },
                {
                    "start": 400.17,
                    "end": 400.59,
                    "word": " ensures",
                    "probability": 0.66064453125
                },
                {
                    "start": 400.59,
                    "end": 400.81,
                    "word": " that",
                    "probability": 0.87109375
                },
                {
                    "start": 400.81,
                    "end": 401.07,
                    "word": " only",
                    "probability": 0.85009765625
                },
                {
                    "start": 401.07,
                    "end": 401.31,
                    "word": " one",
                    "probability": 0.81298828125
                },
                {
                    "start": 401.31,
                    "end": 401.73,
                    "word": " instance",
                    "probability": 0.8837890625
                },
                {
                    "start": 401.73,
                    "end": 401.95,
                    "word": " of",
                    "probability": 0.904296875
                },
                {
                    "start": 401.95,
                    "end": 402.17,
                    "word": " coin",
                    "probability": 0.2457275390625
                },
                {
                    "start": 402.17,
                    "end": 402.53,
                    "word": " miner",
                    "probability": 0.2459716796875
                },
                {
                    "start": 402.53,
                    "end": 403.21,
                    "word": " is",
                    "probability": 0.88623046875
                },
                {
                    "start": 403.21,
                    "end": 403.53,
                    "word": " running",
                    "probability": 0.87939453125
                },
                {
                    "start": 403.53,
                    "end": 403.83,
                    "word": " on",
                    "probability": 0.90966796875
                },
                {
                    "start": 403.83,
                    "end": 404.15,
                    "word": " each",
                    "probability": 0.8427734375
                },
                {
                    "start": 404.15,
                    "end": 404.47,
                    "word": " infected",
                    "probability": 0.94482421875
                },
                {
                    "start": 404.47,
                    "end": 404.97,
                    "word": " device",
                    "probability": 0.88916015625
                },
                {
                    "start": 404.97,
                    "end": 405.63,
                    "word": ".",
                    "probability": 0.96923828125
                }
            ]
        },
        {
            "id": 91,
            "seek": 41780,
            "start": 405.77,
            "end": 418.15,
            "text": " I need to add that this mutex name can be used as an additional indicator of compromise and also it can be used for finding another related samples in public databases.",
            "tokens": [
                50914,
                286,
                643,
                281,
                909,
                300,
                341,
                24523,
                87,
                1315,
                393,
                312,
                1143,
                382,
                364,
                4497,
                16961,
                295,
                18577,
                293,
                611,
                309,
                393,
                312,
                1143,
                337,
                5006,
                1071,
                4077,
                10938,
                294,
                1908,
                22380,
                13,
                51564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.25367646445246306,
            "compression_ratio": 1.578125,
            "no_speech_prob": 0.188720703125,
            "words": [
                {
                    "start": 405.77,
                    "end": 405.91,
                    "word": " I",
                    "probability": 0.98095703125
                },
                {
                    "start": 405.91,
                    "end": 406.07,
                    "word": " need",
                    "probability": 0.8251953125
                },
                {
                    "start": 406.07,
                    "end": 406.25,
                    "word": " to",
                    "probability": 0.90673828125
                },
                {
                    "start": 406.25,
                    "end": 406.51,
                    "word": " add",
                    "probability": 0.83056640625
                },
                {
                    "start": 406.51,
                    "end": 406.89,
                    "word": " that",
                    "probability": 0.84228515625
                },
                {
                    "start": 406.89,
                    "end": 407.13,
                    "word": " this",
                    "probability": 0.8310546875
                },
                {
                    "start": 407.13,
                    "end": 407.49,
                    "word": " mutex",
                    "probability": 0.8701171875
                },
                {
                    "start": 407.49,
                    "end": 407.77,
                    "word": " name",
                    "probability": 0.8232421875
                },
                {
                    "start": 407.77,
                    "end": 408.01,
                    "word": " can",
                    "probability": 0.88916015625
                },
                {
                    "start": 408.01,
                    "end": 408.17,
                    "word": " be",
                    "probability": 0.896484375
                },
                {
                    "start": 408.17,
                    "end": 408.43,
                    "word": " used",
                    "probability": 0.802734375
                },
                {
                    "start": 408.43,
                    "end": 408.69,
                    "word": " as",
                    "probability": 0.89697265625
                },
                {
                    "start": 408.69,
                    "end": 409.05,
                    "word": " an",
                    "probability": 0.8974609375
                },
                {
                    "start": 409.05,
                    "end": 409.55,
                    "word": " additional",
                    "probability": 0.8681640625
                },
                {
                    "start": 409.55,
                    "end": 410.05,
                    "word": " indicator",
                    "probability": 0.923828125
                },
                {
                    "start": 410.05,
                    "end": 410.25,
                    "word": " of",
                    "probability": 0.9072265625
                },
                {
                    "start": 410.25,
                    "end": 410.65,
                    "word": " compromise",
                    "probability": 0.74267578125
                },
                {
                    "start": 410.65,
                    "end": 411.69,
                    "word": " and",
                    "probability": 0.5908203125
                },
                {
                    "start": 411.69,
                    "end": 412.41,
                    "word": " also",
                    "probability": 0.76171875
                },
                {
                    "start": 412.41,
                    "end": 412.71,
                    "word": " it",
                    "probability": 0.78271484375
                },
                {
                    "start": 412.71,
                    "end": 412.83,
                    "word": " can",
                    "probability": 0.89990234375
                },
                {
                    "start": 412.83,
                    "end": 412.97,
                    "word": " be",
                    "probability": 0.90234375
                },
                {
                    "start": 412.97,
                    "end": 413.21,
                    "word": " used",
                    "probability": 0.80712890625
                },
                {
                    "start": 413.21,
                    "end": 413.43,
                    "word": " for",
                    "probability": 0.8994140625
                },
                {
                    "start": 413.43,
                    "end": 413.85,
                    "word": " finding",
                    "probability": 0.7216796875
                },
                {
                    "start": 413.85,
                    "end": 414.17,
                    "word": " another",
                    "probability": 0.5546875
                },
                {
                    "start": 414.17,
                    "end": 414.69,
                    "word": " related",
                    "probability": 0.84033203125
                },
                {
                    "start": 414.69,
                    "end": 415.85,
                    "word": " samples",
                    "probability": 0.73291015625
                },
                {
                    "start": 415.85,
                    "end": 416.47,
                    "word": " in",
                    "probability": 0.90283203125
                },
                {
                    "start": 416.47,
                    "end": 416.97,
                    "word": " public",
                    "probability": 0.8125
                },
                {
                    "start": 416.97,
                    "end": 417.49,
                    "word": " databases",
                    "probability": 0.87744140625
                },
                {
                    "start": 417.49,
                    "end": 418.15,
                    "word": ".",
                    "probability": 0.98681640625
                }
            ]
        },
        {
            "id": 92,
            "seek": 44430,
            "start": 420.48,
            "end": 426.74,
            "text": " While the most detected fake DLLs had the same hash, there was only one with different hash.",
            "tokens": [
                50414,
                3987,
                264,
                881,
                21896,
                7592,
                413,
                24010,
                82,
                632,
                264,
                912,
                22019,
                11,
                456,
                390,
                787,
                472,
                365,
                819,
                22019,
                13,
                50714
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2637246557184168,
            "compression_ratio": 1.5613207547169812,
            "no_speech_prob": 0.2423095703125,
            "words": [
                {
                    "start": 420.48,
                    "end": 421.18,
                    "word": " While",
                    "probability": 0.41845703125
                },
                {
                    "start": 421.18,
                    "end": 421.56,
                    "word": " the",
                    "probability": 0.80126953125
                },
                {
                    "start": 421.56,
                    "end": 421.76,
                    "word": " most",
                    "probability": 0.81396484375
                },
                {
                    "start": 421.76,
                    "end": 422.14,
                    "word": " detected",
                    "probability": 0.76416015625
                },
                {
                    "start": 422.14,
                    "end": 422.48,
                    "word": " fake",
                    "probability": 0.677734375
                },
                {
                    "start": 422.48,
                    "end": 423.02,
                    "word": " DLLs",
                    "probability": 0.742919921875
                },
                {
                    "start": 423.02,
                    "end": 423.18,
                    "word": " had",
                    "probability": 0.7724609375
                },
                {
                    "start": 423.18,
                    "end": 423.38,
                    "word": " the",
                    "probability": 0.79931640625
                },
                {
                    "start": 423.38,
                    "end": 423.6,
                    "word": " same",
                    "probability": 0.8046875
                },
                {
                    "start": 423.6,
                    "end": 423.9,
                    "word": " hash",
                    "probability": 0.72607421875
                },
                {
                    "start": 423.9,
                    "end": 424.28,
                    "word": ",",
                    "probability": 0.8662109375
                },
                {
                    "start": 424.28,
                    "end": 424.44,
                    "word": " there",
                    "probability": 0.83740234375
                },
                {
                    "start": 424.44,
                    "end": 424.66,
                    "word": " was",
                    "probability": 0.880859375
                },
                {
                    "start": 424.66,
                    "end": 424.88,
                    "word": " only",
                    "probability": 0.84326171875
                },
                {
                    "start": 424.88,
                    "end": 425.16,
                    "word": " one",
                    "probability": 0.80908203125
                },
                {
                    "start": 425.16,
                    "end": 425.34,
                    "word": " with",
                    "probability": 0.77783203125
                },
                {
                    "start": 425.34,
                    "end": 425.68,
                    "word": " different",
                    "probability": 0.434326171875
                },
                {
                    "start": 425.68,
                    "end": 426.04,
                    "word": " hash",
                    "probability": 0.77685546875
                },
                {
                    "start": 426.04,
                    "end": 426.74,
                    "word": ".",
                    "probability": 0.966796875
                }
            ]
        },
        {
            "id": 93,
            "seek": 44430,
            "start": 426.88,
            "end": 439.81,
            "text": " It executed the command line with the command for creation of scheduled task called windows-problem-collections and as well as other persistence via services.",
            "tokens": [
                50714,
                467,
                17577,
                264,
                5622,
                1622,
                365,
                264,
                5622,
                337,
                8016,
                295,
                15678,
                5633,
                1219,
                9309,
                12,
                47419,
                12,
                33891,
                557,
                626,
                293,
                382,
                731,
                382,
                661,
                37617,
                5766,
                3328,
                13,
                51364
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2637246557184168,
            "compression_ratio": 1.5613207547169812,
            "no_speech_prob": 0.2423095703125,
            "words": [
                {
                    "start": 426.88,
                    "end": 427.1,
                    "word": " It",
                    "probability": 0.89599609375
                },
                {
                    "start": 427.1,
                    "end": 427.58,
                    "word": " executed",
                    "probability": 0.79248046875
                },
                {
                    "start": 427.58,
                    "end": 428.06,
                    "word": " the",
                    "probability": 0.8125
                },
                {
                    "start": 428.06,
                    "end": 428.74,
                    "word": " command",
                    "probability": 0.77978515625
                },
                {
                    "start": 428.74,
                    "end": 429.08,
                    "word": " line",
                    "probability": 0.857421875
                },
                {
                    "start": 429.08,
                    "end": 429.78,
                    "word": " with",
                    "probability": 0.73876953125
                },
                {
                    "start": 429.78,
                    "end": 429.98,
                    "word": " the",
                    "probability": 0.810546875
                },
                {
                    "start": 429.98,
                    "end": 430.28,
                    "word": " command",
                    "probability": 0.76318359375
                },
                {
                    "start": 430.28,
                    "end": 430.52,
                    "word": " for",
                    "probability": 0.89013671875
                },
                {
                    "start": 430.52,
                    "end": 431.02,
                    "word": " creation",
                    "probability": 0.78857421875
                },
                {
                    "start": 431.02,
                    "end": 431.44,
                    "word": " of",
                    "probability": 0.90625
                },
                {
                    "start": 431.44,
                    "end": 431.78,
                    "word": " scheduled",
                    "probability": 0.482421875
                },
                {
                    "start": 431.78,
                    "end": 432.2,
                    "word": " task",
                    "probability": 0.60498046875
                },
                {
                    "start": 432.2,
                    "end": 432.68,
                    "word": " called",
                    "probability": 0.77392578125
                },
                {
                    "start": 432.68,
                    "end": 433.76,
                    "word": " windows",
                    "probability": 0.1600341796875
                },
                {
                    "start": 433.76,
                    "end": 434.14,
                    "word": "-problem",
                    "probability": 0.5218505859375
                },
                {
                    "start": 434.14,
                    "end": 435.24,
                    "word": "-collections",
                    "probability": 0.8458251953125
                },
                {
                    "start": 435.24,
                    "end": 436.14,
                    "word": " and",
                    "probability": 0.3427734375
                },
                {
                    "start": 436.14,
                    "end": 436.46,
                    "word": " as",
                    "probability": 0.81201171875
                },
                {
                    "start": 436.46,
                    "end": 436.76,
                    "word": " well",
                    "probability": 0.86181640625
                },
                {
                    "start": 436.76,
                    "end": 437.72,
                    "word": " as",
                    "probability": 0.8603515625
                },
                {
                    "start": 437.72,
                    "end": 438.04,
                    "word": " other",
                    "probability": 0.77587890625
                },
                {
                    "start": 438.04,
                    "end": 438.58,
                    "word": " persistence",
                    "probability": 0.2734375
                },
                {
                    "start": 438.58,
                    "end": 438.82,
                    "word": " via",
                    "probability": 0.45361328125
                },
                {
                    "start": 438.82,
                    "end": 439.46,
                    "word": " services",
                    "probability": 0.8701171875
                },
                {
                    "start": 439.46,
                    "end": 439.81,
                    "word": ".",
                    "probability": 0.9521484375
                }
            ]
        },
        {
            "id": 94,
            "seek": 44430,
            "start": 440.28,
            "end": 446.02,
            "text": " Thus, it was responsible for one part of persistent mechanism we already found.",
            "tokens": [
                51364,
                13827,
                11,
                309,
                390,
                6250,
                337,
                472,
                644,
                295,
                24315,
                7513,
                321,
                1217,
                1352,
                13,
                51664
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2637246557184168,
            "compression_ratio": 1.5613207547169812,
            "no_speech_prob": 0.2423095703125,
            "words": [
                {
                    "start": 440.28,
                    "end": 440.52,
                    "word": " Thus",
                    "probability": 0.6025390625
                },
                {
                    "start": 440.52,
                    "end": 440.98,
                    "word": ",",
                    "probability": 0.87060546875
                },
                {
                    "start": 440.98,
                    "end": 441.16,
                    "word": " it",
                    "probability": 0.89111328125
                },
                {
                    "start": 441.16,
                    "end": 441.36,
                    "word": " was",
                    "probability": 0.90185546875
                },
                {
                    "start": 441.36,
                    "end": 441.78,
                    "word": " responsible",
                    "probability": 0.81103515625
                },
                {
                    "start": 441.78,
                    "end": 442.24,
                    "word": " for",
                    "probability": 0.89501953125
                },
                {
                    "start": 442.24,
                    "end": 442.62,
                    "word": " one",
                    "probability": 0.802734375
                },
                {
                    "start": 442.62,
                    "end": 442.94,
                    "word": " part",
                    "probability": 0.8291015625
                },
                {
                    "start": 442.94,
                    "end": 443.26,
                    "word": " of",
                    "probability": 0.90234375
                },
                {
                    "start": 443.26,
                    "end": 443.84,
                    "word": " persistent",
                    "probability": 0.2900390625
                },
                {
                    "start": 443.84,
                    "end": 444.36,
                    "word": " mechanism",
                    "probability": 0.861328125
                },
                {
                    "start": 444.36,
                    "end": 444.66,
                    "word": " we",
                    "probability": 0.87890625
                },
                {
                    "start": 444.66,
                    "end": 444.98,
                    "word": " already",
                    "probability": 0.8291015625
                },
                {
                    "start": 444.98,
                    "end": 445.32,
                    "word": " found",
                    "probability": 0.88720703125
                },
                {
                    "start": 445.32,
                    "end": 446.02,
                    "word": ".",
                    "probability": 0.94091796875
                }
            ]
        },
        {
            "id": 95,
            "seek": 46960,
            "start": 446.02,
            "end": 452.98,
            "text": " But the question is, what else attacker deployed in the client network and how they got access to the network?",
            "tokens": [
                50364,
                583,
                264,
                1168,
                307,
                11,
                437,
                1646,
                35871,
                17826,
                294,
                264,
                6423,
                3209,
                293,
                577,
                436,
                658,
                2105,
                281,
                264,
                3209,
                30,
                50714
            ],
            "temperature": 0.0,
            "avg_logprob": -0.280405394128851,
            "compression_ratio": 1.5758928571428572,
            "no_speech_prob": 0.07177734375,
            "words": [
                {
                    "start": 446.02,
                    "end": 446.44,
                    "word": " But",
                    "probability": 0.66015625
                },
                {
                    "start": 446.44,
                    "end": 446.58,
                    "word": " the",
                    "probability": 0.8037109375
                },
                {
                    "start": 446.58,
                    "end": 446.88,
                    "word": " question",
                    "probability": 0.79833984375
                },
                {
                    "start": 446.88,
                    "end": 447.26,
                    "word": " is",
                    "probability": 0.90869140625
                },
                {
                    "start": 447.26,
                    "end": 447.36,
                    "word": ",",
                    "probability": 0.495849609375
                },
                {
                    "start": 447.36,
                    "end": 447.56,
                    "word": " what",
                    "probability": 0.86376953125
                },
                {
                    "start": 447.56,
                    "end": 447.86,
                    "word": " else",
                    "probability": 0.8466796875
                },
                {
                    "start": 447.86,
                    "end": 448.16,
                    "word": " attacker",
                    "probability": 0.053924560546875
                },
                {
                    "start": 448.16,
                    "end": 448.76,
                    "word": " deployed",
                    "probability": 0.708984375
                },
                {
                    "start": 448.76,
                    "end": 449.0,
                    "word": " in",
                    "probability": 0.8076171875
                },
                {
                    "start": 449.0,
                    "end": 449.14,
                    "word": " the",
                    "probability": 0.78466796875
                },
                {
                    "start": 449.14,
                    "end": 449.4,
                    "word": " client",
                    "probability": 0.912109375
                },
                {
                    "start": 449.4,
                    "end": 449.86,
                    "word": " network",
                    "probability": 0.80810546875
                },
                {
                    "start": 449.86,
                    "end": 450.5,
                    "word": " and",
                    "probability": 0.61962890625
                },
                {
                    "start": 450.5,
                    "end": 450.78,
                    "word": " how",
                    "probability": 0.896484375
                },
                {
                    "start": 450.78,
                    "end": 450.96,
                    "word": " they",
                    "probability": 0.70849609375
                },
                {
                    "start": 450.96,
                    "end": 451.18,
                    "word": " got",
                    "probability": 0.87353515625
                },
                {
                    "start": 451.18,
                    "end": 451.54,
                    "word": " access",
                    "probability": 0.7763671875
                },
                {
                    "start": 451.54,
                    "end": 451.82,
                    "word": " to",
                    "probability": 0.904296875
                },
                {
                    "start": 451.82,
                    "end": 451.96,
                    "word": " the",
                    "probability": 0.80859375
                },
                {
                    "start": 451.96,
                    "end": 452.36,
                    "word": " network",
                    "probability": 0.8408203125
                },
                {
                    "start": 452.36,
                    "end": 452.98,
                    "word": "?",
                    "probability": 0.5849609375
                }
            ]
        },
        {
            "id": 96,
            "seek": 46960,
            "start": 454.16,
            "end": 462.78,
            "text": " First steps of forensic analysis revealed the one batch file called x.bat and couple of suspicious tasks.",
            "tokens": [
                50714,
                2386,
                4439,
                295,
                39084,
                5215,
                9599,
                264,
                472,
                15245,
                3991,
                1219,
                2031,
                13,
                11980,
                293,
                1916,
                295,
                17931,
                9608,
                13,
                51214
            ],
            "temperature": 0.0,
            "avg_logprob": -0.280405394128851,
            "compression_ratio": 1.5758928571428572,
            "no_speech_prob": 0.07177734375,
            "words": [
                {
                    "start": 454.16,
                    "end": 454.78,
                    "word": " First",
                    "probability": 0.767578125
                },
                {
                    "start": 454.78,
                    "end": 455.06,
                    "word": " steps",
                    "probability": 0.6630859375
                },
                {
                    "start": 455.06,
                    "end": 455.42,
                    "word": " of",
                    "probability": 0.9013671875
                },
                {
                    "start": 455.42,
                    "end": 455.86,
                    "word": " forensic",
                    "probability": 0.7138671875
                },
                {
                    "start": 455.86,
                    "end": 456.4,
                    "word": " analysis",
                    "probability": 0.69091796875
                },
                {
                    "start": 456.4,
                    "end": 457.54,
                    "word": " revealed",
                    "probability": 0.89990234375
                },
                {
                    "start": 457.54,
                    "end": 458.3,
                    "word": " the",
                    "probability": 0.78173828125
                },
                {
                    "start": 458.3,
                    "end": 458.56,
                    "word": " one",
                    "probability": 0.78369140625
                },
                {
                    "start": 458.56,
                    "end": 458.76,
                    "word": " batch",
                    "probability": 0.7275390625
                },
                {
                    "start": 458.76,
                    "end": 459.04,
                    "word": " file",
                    "probability": 0.693359375
                },
                {
                    "start": 459.04,
                    "end": 459.48,
                    "word": " called",
                    "probability": 0.6708984375
                },
                {
                    "start": 459.48,
                    "end": 459.78,
                    "word": " x",
                    "probability": 0.49951171875
                },
                {
                    "start": 459.78,
                    "end": 460.2,
                    "word": ".bat",
                    "probability": 0.80859375
                },
                {
                    "start": 460.2,
                    "end": 460.94,
                    "word": " and",
                    "probability": 0.7958984375
                },
                {
                    "start": 460.94,
                    "end": 461.2,
                    "word": " couple",
                    "probability": 0.50341796875
                },
                {
                    "start": 461.2,
                    "end": 461.38,
                    "word": " of",
                    "probability": 0.89892578125
                },
                {
                    "start": 461.38,
                    "end": 461.68,
                    "word": " suspicious",
                    "probability": 0.74169921875
                },
                {
                    "start": 461.68,
                    "end": 462.16,
                    "word": " tasks",
                    "probability": 0.85498046875
                },
                {
                    "start": 462.16,
                    "end": 462.78,
                    "word": ".",
                    "probability": 0.93017578125
                }
            ]
        },
        {
            "id": 97,
            "seek": 46960,
            "start": 463.4,
            "end": 471.32,
            "text": " The batch file contained the PowerShell downloader, which downloads additional content from JavaScript resource on the local web server.",
            "tokens": [
                51214,
                440,
                15245,
                3991,
                16212,
                264,
                7086,
                9526,
                285,
                5484,
                260,
                11,
                597,
                36553,
                4497,
                2701,
                490,
                15778,
                7684,
                322,
                264,
                2654,
                3670,
                7154,
                13,
                51614
            ],
            "temperature": 0.0,
            "avg_logprob": -0.280405394128851,
            "compression_ratio": 1.5758928571428572,
            "no_speech_prob": 0.07177734375,
            "words": [
                {
                    "start": 463.4,
                    "end": 463.74,
                    "word": " The",
                    "probability": 0.79736328125
                },
                {
                    "start": 463.74,
                    "end": 463.94,
                    "word": " batch",
                    "probability": 0.75634765625
                },
                {
                    "start": 463.94,
                    "end": 464.4,
                    "word": " file",
                    "probability": 0.77734375
                },
                {
                    "start": 464.4,
                    "end": 465.48,
                    "word": " contained",
                    "probability": 0.52197265625
                },
                {
                    "start": 465.48,
                    "end": 465.72,
                    "word": " the",
                    "probability": 0.7724609375
                },
                {
                    "start": 465.72,
                    "end": 466.08,
                    "word": " PowerShell",
                    "probability": 0.91064453125
                },
                {
                    "start": 466.08,
                    "end": 466.72,
                    "word": " downloader",
                    "probability": 0.79443359375
                },
                {
                    "start": 466.72,
                    "end": 467.08,
                    "word": ",",
                    "probability": 0.5361328125
                },
                {
                    "start": 467.08,
                    "end": 467.28,
                    "word": " which",
                    "probability": 0.93017578125
                },
                {
                    "start": 467.28,
                    "end": 467.8,
                    "word": " downloads",
                    "probability": 0.8671875
                },
                {
                    "start": 467.8,
                    "end": 468.28,
                    "word": " additional",
                    "probability": 0.88720703125
                },
                {
                    "start": 468.28,
                    "end": 468.68,
                    "word": " content",
                    "probability": 0.7978515625
                },
                {
                    "start": 468.68,
                    "end": 468.94,
                    "word": " from",
                    "probability": 0.81396484375
                },
                {
                    "start": 468.94,
                    "end": 469.26,
                    "word": " JavaScript",
                    "probability": 0.73974609375
                },
                {
                    "start": 469.26,
                    "end": 469.76,
                    "word": " resource",
                    "probability": 0.8056640625
                },
                {
                    "start": 469.76,
                    "end": 469.98,
                    "word": " on",
                    "probability": 0.89892578125
                },
                {
                    "start": 469.98,
                    "end": 470.1,
                    "word": " the",
                    "probability": 0.8095703125
                },
                {
                    "start": 470.1,
                    "end": 470.32,
                    "word": " local",
                    "probability": 0.87890625
                },
                {
                    "start": 470.32,
                    "end": 470.5,
                    "word": " web",
                    "probability": 0.64404296875
                },
                {
                    "start": 470.5,
                    "end": 470.7,
                    "word": " server",
                    "probability": 0.86279296875
                },
                {
                    "start": 470.7,
                    "end": 471.32,
                    "word": ".",
                    "probability": 0.97998046875
                }
            ]
        },
        {
            "id": 98,
            "seek": 48902,
            "start": 471.32,
            "end": 477.58,
            "text": " However, it was not JavaScript, but PowerShell, which created the scheduled task.",
            "tokens": [
                50364,
                2908,
                11,
                309,
                390,
                406,
                15778,
                11,
                457,
                7086,
                9526,
                285,
                11,
                597,
                2942,
                264,
                15678,
                5633,
                13,
                50664
            ],
            "temperature": 0.0,
            "avg_logprob": -0.25882056018998545,
            "compression_ratio": 1.4545454545454546,
            "no_speech_prob": 0.13037109375,
            "words": [
                {
                    "start": 471.32,
                    "end": 471.54,
                    "word": " However",
                    "probability": 0.6904296875
                },
                {
                    "start": 471.54,
                    "end": 472.1,
                    "word": ",",
                    "probability": 0.962890625
                },
                {
                    "start": 472.1,
                    "end": 472.26,
                    "word": " it",
                    "probability": 0.88232421875
                },
                {
                    "start": 472.26,
                    "end": 472.42,
                    "word": " was",
                    "probability": 0.86376953125
                },
                {
                    "start": 472.42,
                    "end": 472.58,
                    "word": " not",
                    "probability": 0.8486328125
                },
                {
                    "start": 472.58,
                    "end": 473.02,
                    "word": " JavaScript",
                    "probability": 0.7734375
                },
                {
                    "start": 473.02,
                    "end": 473.42,
                    "word": ",",
                    "probability": 0.57275390625
                },
                {
                    "start": 473.42,
                    "end": 473.52,
                    "word": " but",
                    "probability": 0.90234375
                },
                {
                    "start": 473.52,
                    "end": 474.16,
                    "word": " PowerShell",
                    "probability": 0.9112955729166666
                },
                {
                    "start": 474.16,
                    "end": 474.74,
                    "word": ",",
                    "probability": 0.57421875
                },
                {
                    "start": 474.74,
                    "end": 474.82,
                    "word": " which",
                    "probability": 0.9150390625
                },
                {
                    "start": 474.82,
                    "end": 475.3,
                    "word": " created",
                    "probability": 0.7099609375
                },
                {
                    "start": 475.3,
                    "end": 476.38,
                    "word": " the",
                    "probability": 0.76123046875
                },
                {
                    "start": 476.38,
                    "end": 476.74,
                    "word": " scheduled",
                    "probability": 0.37060546875
                },
                {
                    "start": 476.74,
                    "end": 477.18,
                    "word": " task",
                    "probability": 0.52880859375
                },
                {
                    "start": 477.18,
                    "end": 477.58,
                    "word": ".",
                    "probability": 0.64013671875
                }
            ]
        },
        {
            "id": 99,
            "seek": 48902,
            "start": 477.92,
            "end": 482.32,
            "text": " And these scheduled tasks used the file called scriptstamp.",
            "tokens": [
                50664,
                400,
                613,
                15678,
                9608,
                1143,
                264,
                3991,
                1219,
                5755,
                372,
                1215,
                13,
                50914
            ],
            "temperature": 0.0,
            "avg_logprob": -0.25882056018998545,
            "compression_ratio": 1.4545454545454546,
            "no_speech_prob": 0.13037109375,
            "words": [
                {
                    "start": 477.92,
                    "end": 478.04,
                    "word": " And",
                    "probability": 0.70556640625
                },
                {
                    "start": 478.04,
                    "end": 478.18,
                    "word": " these",
                    "probability": 0.349609375
                },
                {
                    "start": 478.18,
                    "end": 478.44,
                    "word": " scheduled",
                    "probability": 0.708984375
                },
                {
                    "start": 478.44,
                    "end": 478.98,
                    "word": " tasks",
                    "probability": 0.84521484375
                },
                {
                    "start": 478.98,
                    "end": 479.9,
                    "word": " used",
                    "probability": 0.77294921875
                },
                {
                    "start": 479.9,
                    "end": 480.18,
                    "word": " the",
                    "probability": 0.80224609375
                },
                {
                    "start": 480.18,
                    "end": 480.66,
                    "word": " file",
                    "probability": 0.8251953125
                },
                {
                    "start": 480.66,
                    "end": 481.24,
                    "word": " called",
                    "probability": 0.8173828125
                },
                {
                    "start": 481.24,
                    "end": 481.9,
                    "word": " scriptstamp",
                    "probability": 0.5415852864583334
                },
                {
                    "start": 481.9,
                    "end": 482.32,
                    "word": ".",
                    "probability": 0.97509765625
                }
            ]
        },
        {
            "id": 100,
            "seek": 48902,
            "start": 482.32,
            "end": 487.78,
            "text": " In our case, it contains a backdoor, a Netcat backdoor.",
            "tokens": [
                50914,
                682,
                527,
                1389,
                11,
                309,
                8306,
                257,
                646,
                10441,
                11,
                257,
                6188,
                18035,
                646,
                10441,
                13,
                51164
            ],
            "temperature": 0.0,
            "avg_logprob": -0.25882056018998545,
            "compression_ratio": 1.4545454545454546,
            "no_speech_prob": 0.13037109375,
            "words": [
                {
                    "start": 482.32,
                    "end": 482.56,
                    "word": " In",
                    "probability": 0.90283203125
                },
                {
                    "start": 482.56,
                    "end": 482.86,
                    "word": " our",
                    "probability": 0.80859375
                },
                {
                    "start": 482.86,
                    "end": 483.28,
                    "word": " case",
                    "probability": 0.81884765625
                },
                {
                    "start": 483.28,
                    "end": 483.9,
                    "word": ",",
                    "probability": 0.94970703125
                },
                {
                    "start": 483.9,
                    "end": 484.08,
                    "word": " it",
                    "probability": 0.90234375
                },
                {
                    "start": 484.08,
                    "end": 484.74,
                    "word": " contains",
                    "probability": 0.8486328125
                },
                {
                    "start": 485.12,
                    "end": 485.56,
                    "word": " a backdoor",
                    "probability": 0.7265625
                },
                {
                    "start": 485.56,
                    "end": 486.18,
                    "word": ",",
                    "probability": 0.85107421875
                },
                {
                    "start": 486.26,
                    "end": 486.58,
                    "word": " a Netcat",
                    "probability": 0.71533203125
                },
                {
                    "start": 486.58,
                    "end": 486.98,
                    "word": " backdoor",
                    "probability": 0.88427734375
                },
                {
                    "start": 486.98,
                    "end": 487.78,
                    "word": ".",
                    "probability": 0.98779296875
                }
            ]
        },
        {
            "id": 101,
            "seek": 48902,
            "start": 488.14,
            "end": 490.74,
            "text": " And what about its origin?",
            "tokens": [
                51164,
                400,
                437,
                466,
                1080,
                4957,
                30,
                51314
            ],
            "temperature": 0.0,
            "avg_logprob": -0.25882056018998545,
            "compression_ratio": 1.4545454545454546,
            "no_speech_prob": 0.13037109375,
            "words": [
                {
                    "start": 488.14,
                    "end": 488.62,
                    "word": " And",
                    "probability": 0.8623046875
                },
                {
                    "start": 488.62,
                    "end": 489.0,
                    "word": " what",
                    "probability": 0.857421875
                },
                {
                    "start": 489.0,
                    "end": 489.32,
                    "word": " about",
                    "probability": 0.82763671875
                },
                {
                    "start": 489.32,
                    "end": 489.56,
                    "word": " its",
                    "probability": 0.791015625
                },
                {
                    "start": 489.56,
                    "end": 489.94,
                    "word": " origin",
                    "probability": 0.7646484375
                },
                {
                    "start": 489.94,
                    "end": 490.74,
                    "word": "?",
                    "probability": 0.9794921875
                }
            ]
        },
        {
            "id": 102,
            "seek": 51836,
            "start": 490.74,
            "end": 503.56,
            "text": " The threat intelligence search based on file names and strings led us to the four years old scheduled task backdoor GitHub repository with Chinese comments in readme file.",
            "tokens": [
                50364,
                440,
                4734,
                7599,
                3164,
                2361,
                322,
                3991,
                5288,
                293,
                13985,
                4684,
                505,
                281,
                264,
                1451,
                924,
                1331,
                15678,
                5633,
                646,
                10441,
                23331,
                25841,
                365,
                4649,
                3053,
                294,
                1401,
                1398,
                3991,
                13,
                51064
            ],
            "temperature": 0.0,
            "avg_logprob": -0.29326923267963606,
            "compression_ratio": 1.4956140350877194,
            "no_speech_prob": 0.1357421875,
            "words": [
                {
                    "start": 490.74,
                    "end": 490.96,
                    "word": " The",
                    "probability": 0.66015625
                },
                {
                    "start": 490.96,
                    "end": 491.2,
                    "word": " threat",
                    "probability": 0.314208984375
                },
                {
                    "start": 491.2,
                    "end": 491.68,
                    "word": " intelligence",
                    "probability": 0.74267578125
                },
                {
                    "start": 491.68,
                    "end": 492.44,
                    "word": " search",
                    "probability": 0.87158203125
                },
                {
                    "start": 492.44,
                    "end": 492.96,
                    "word": " based",
                    "probability": 0.7744140625
                },
                {
                    "start": 492.96,
                    "end": 493.26,
                    "word": " on",
                    "probability": 0.9111328125
                },
                {
                    "start": 493.26,
                    "end": 493.62,
                    "word": " file",
                    "probability": 0.6552734375
                },
                {
                    "start": 493.62,
                    "end": 494.0,
                    "word": " names",
                    "probability": 0.78125
                },
                {
                    "start": 494.0,
                    "end": 494.4,
                    "word": " and",
                    "probability": 0.88671875
                },
                {
                    "start": 494.4,
                    "end": 494.92,
                    "word": " strings",
                    "probability": 0.515625
                },
                {
                    "start": 494.92,
                    "end": 495.64,
                    "word": " led",
                    "probability": 0.58447265625
                },
                {
                    "start": 495.64,
                    "end": 495.94,
                    "word": " us",
                    "probability": 0.9052734375
                },
                {
                    "start": 495.94,
                    "end": 496.28,
                    "word": " to",
                    "probability": 0.9013671875
                },
                {
                    "start": 496.28,
                    "end": 496.72,
                    "word": " the",
                    "probability": 0.77734375
                },
                {
                    "start": 496.72,
                    "end": 497.02,
                    "word": " four",
                    "probability": 0.73681640625
                },
                {
                    "start": 497.02,
                    "end": 497.38,
                    "word": " years",
                    "probability": 0.7578125
                },
                {
                    "start": 497.38,
                    "end": 497.82,
                    "word": " old",
                    "probability": 0.759765625
                },
                {
                    "start": 497.82,
                    "end": 498.16,
                    "word": " scheduled",
                    "probability": 0.31787109375
                },
                {
                    "start": 498.16,
                    "end": 498.6,
                    "word": " task",
                    "probability": 0.6064453125
                },
                {
                    "start": 498.6,
                    "end": 499.08,
                    "word": " backdoor",
                    "probability": 0.73291015625
                },
                {
                    "start": 499.08,
                    "end": 499.34,
                    "word": " GitHub",
                    "probability": 0.46630859375
                },
                {
                    "start": 499.34,
                    "end": 499.98,
                    "word": " repository",
                    "probability": 0.796875
                },
                {
                    "start": 499.98,
                    "end": 500.92,
                    "word": " with",
                    "probability": 0.5888671875
                },
                {
                    "start": 500.92,
                    "end": 501.28,
                    "word": " Chinese",
                    "probability": 0.76416015625
                },
                {
                    "start": 501.28,
                    "end": 501.7,
                    "word": " comments",
                    "probability": 0.71142578125
                },
                {
                    "start": 501.7,
                    "end": 501.96,
                    "word": " in",
                    "probability": 0.888671875
                },
                {
                    "start": 501.96,
                    "end": 502.36,
                    "word": " readme",
                    "probability": 0.72216796875
                },
                {
                    "start": 502.36,
                    "end": 502.72,
                    "word": " file",
                    "probability": 0.7568359375
                },
                {
                    "start": 502.72,
                    "end": 503.56,
                    "word": ".",
                    "probability": 0.98876953125
                }
            ]
        },
        {
            "id": 103,
            "seek": 51836,
            "start": 506.54,
            "end": 514.94,
            "text": " Forensic analysis also revealed DLLs files dropped by IIS worker process.",
            "tokens": [
                51064,
                9018,
                3695,
                299,
                5215,
                611,
                9599,
                413,
                24010,
                82,
                7098,
                8119,
                538,
                286,
                2343,
                11346,
                1399,
                13,
                51464
            ],
            "temperature": 0.0,
            "avg_logprob": -0.29326923267963606,
            "compression_ratio": 1.4956140350877194,
            "no_speech_prob": 0.1357421875,
            "words": [
                {
                    "start": 506.54,
                    "end": 507.22,
                    "word": " Forensic",
                    "probability": 0.8974609375
                },
                {
                    "start": 507.22,
                    "end": 507.92,
                    "word": " analysis",
                    "probability": 0.681640625
                },
                {
                    "start": 507.92,
                    "end": 509.0,
                    "word": " also",
                    "probability": 0.7841796875
                },
                {
                    "start": 509.0,
                    "end": 509.54,
                    "word": " revealed",
                    "probability": 0.8857421875
                },
                {
                    "start": 509.54,
                    "end": 510.34,
                    "word": " DLLs",
                    "probability": 0.8956705729166666
                },
                {
                    "start": 510.34,
                    "end": 510.82,
                    "word": " files",
                    "probability": 0.7509765625
                },
                {
                    "start": 510.82,
                    "end": 511.56,
                    "word": " dropped",
                    "probability": 0.477783203125
                },
                {
                    "start": 511.56,
                    "end": 512.08,
                    "word": " by",
                    "probability": 0.91845703125
                },
                {
                    "start": 512.08,
                    "end": 513.44,
                    "word": " IIS",
                    "probability": 0.5714111328125
                },
                {
                    "start": 513.44,
                    "end": 513.78,
                    "word": " worker",
                    "probability": 0.63720703125
                },
                {
                    "start": 513.78,
                    "end": 514.28,
                    "word": " process",
                    "probability": 0.8193359375
                },
                {
                    "start": 514.28,
                    "end": 514.94,
                    "word": ".",
                    "probability": 0.9853515625
                }
            ]
        },
        {
            "id": 104,
            "seek": 51836,
            "start": 514.94,
            "end": 522.02,
            "text": " The DLLs files were mixed mode assembly, so they contained both the managed and unmanaged code.",
            "tokens": [
                51464,
                440,
                413,
                24010,
                82,
                7098,
                645,
                7467,
                4391,
                12103,
                11,
                370,
                436,
                16212,
                1293,
                264,
                6453,
                293,
                517,
                1601,
                2980,
                3089,
                13,
                51814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.29326923267963606,
            "compression_ratio": 1.4956140350877194,
            "no_speech_prob": 0.1357421875,
            "words": [
                {
                    "start": 514.94,
                    "end": 515.04,
                    "word": " The",
                    "probability": 0.8125
                },
                {
                    "start": 515.04,
                    "end": 515.56,
                    "word": " DLLs",
                    "probability": 0.9104817708333334
                },
                {
                    "start": 515.56,
                    "end": 516.02,
                    "word": " files",
                    "probability": 0.77001953125
                },
                {
                    "start": 516.02,
                    "end": 516.72,
                    "word": " were",
                    "probability": 0.8017578125
                },
                {
                    "start": 516.72,
                    "end": 517.0,
                    "word": " mixed",
                    "probability": 0.68359375
                },
                {
                    "start": 517.0,
                    "end": 517.28,
                    "word": " mode",
                    "probability": 0.447021484375
                },
                {
                    "start": 517.28,
                    "end": 517.7,
                    "word": " assembly",
                    "probability": 0.5009765625
                },
                {
                    "start": 517.7,
                    "end": 518.5,
                    "word": ",",
                    "probability": 0.50048828125
                },
                {
                    "start": 518.5,
                    "end": 518.74,
                    "word": " so",
                    "probability": 0.89013671875
                },
                {
                    "start": 518.74,
                    "end": 519.08,
                    "word": " they",
                    "probability": 0.74072265625
                },
                {
                    "start": 519.08,
                    "end": 519.8,
                    "word": " contained",
                    "probability": 0.74169921875
                },
                {
                    "start": 519.8,
                    "end": 520.18,
                    "word": " both",
                    "probability": 0.76953125
                },
                {
                    "start": 520.18,
                    "end": 520.4,
                    "word": " the",
                    "probability": 0.76708984375
                },
                {
                    "start": 520.4,
                    "end": 520.76,
                    "word": " managed",
                    "probability": 0.7802734375
                },
                {
                    "start": 520.76,
                    "end": 521.06,
                    "word": " and",
                    "probability": 0.89794921875
                },
                {
                    "start": 521.06,
                    "end": 521.52,
                    "word": " unmanaged",
                    "probability": 0.8875325520833334
                },
                {
                    "start": 521.52,
                    "end": 521.9,
                    "word": " code",
                    "probability": 0.751953125
                },
                {
                    "start": 521.9,
                    "end": 522.02,
                    "word": ".",
                    "probability": 0.984375
                }
            ]
        },
        {
            "id": 105,
            "seek": 54532,
            "start": 522.02,
            "end": 528.24,
            "text": " The .NET part of DLL contains only the empty class. Yes, it was really empty.",
            "tokens": [
                50364,
                440,
                2411,
                35554,
                644,
                295,
                413,
                24010,
                8306,
                787,
                264,
                6707,
                1508,
                13,
                1079,
                11,
                309,
                390,
                534,
                6707,
                13,
                50664
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2157315310429443,
            "compression_ratio": 1.5545454545454545,
            "no_speech_prob": 0.01152801513671875,
            "words": [
                {
                    "start": 522.02,
                    "end": 522.42,
                    "word": " The",
                    "probability": 0.3837890625
                },
                {
                    "start": 522.42,
                    "end": 522.72,
                    "word": " .NET",
                    "probability": 0.802001953125
                },
                {
                    "start": 522.72,
                    "end": 523.1,
                    "word": " part",
                    "probability": 0.79296875
                },
                {
                    "start": 523.1,
                    "end": 523.34,
                    "word": " of",
                    "probability": 0.89453125
                },
                {
                    "start": 523.34,
                    "end": 523.6,
                    "word": " DLL",
                    "probability": 0.900146484375
                },
                {
                    "start": 523.6,
                    "end": 524.14,
                    "word": " contains",
                    "probability": 0.83740234375
                },
                {
                    "start": 524.14,
                    "end": 524.54,
                    "word": " only",
                    "probability": 0.85888671875
                },
                {
                    "start": 524.54,
                    "end": 525.7,
                    "word": " the",
                    "probability": 0.79833984375
                },
                {
                    "start": 525.7,
                    "end": 526.06,
                    "word": " empty",
                    "probability": 0.64990234375
                },
                {
                    "start": 526.06,
                    "end": 526.46,
                    "word": " class",
                    "probability": 0.91015625
                },
                {
                    "start": 526.46,
                    "end": 526.86,
                    "word": ".",
                    "probability": 0.916015625
                },
                {
                    "start": 526.86,
                    "end": 527.08,
                    "word": " Yes",
                    "probability": 0.85400390625
                },
                {
                    "start": 527.08,
                    "end": 527.16,
                    "word": ",",
                    "probability": 0.9091796875
                },
                {
                    "start": 527.16,
                    "end": 527.22,
                    "word": " it",
                    "probability": 0.896484375
                },
                {
                    "start": 527.22,
                    "end": 527.38,
                    "word": " was",
                    "probability": 0.88720703125
                },
                {
                    "start": 527.38,
                    "end": 527.6,
                    "word": " really",
                    "probability": 0.7783203125
                },
                {
                    "start": 527.6,
                    "end": 527.96,
                    "word": " empty",
                    "probability": 0.74609375
                },
                {
                    "start": 527.96,
                    "end": 528.24,
                    "word": ".",
                    "probability": 0.97216796875
                }
            ]
        },
        {
            "id": 106,
            "seek": 54532,
            "start": 528.24,
            "end": 536.26,
            "text": " On the other hand, in the native code, this DLL main dispatcher spent a reverse shell connected to the attacker.",
            "tokens": [
                50664,
                1282,
                264,
                661,
                1011,
                11,
                294,
                264,
                8470,
                3089,
                11,
                341,
                413,
                24010,
                2135,
                36729,
                260,
                4418,
                257,
                9943,
                8720,
                4582,
                281,
                264,
                35871,
                13,
                51064
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2157315310429443,
            "compression_ratio": 1.5545454545454545,
            "no_speech_prob": 0.01152801513671875,
            "words": [
                {
                    "start": 528.24,
                    "end": 528.4,
                    "word": " On",
                    "probability": 0.89306640625
                },
                {
                    "start": 528.4,
                    "end": 528.52,
                    "word": " the",
                    "probability": 0.81103515625
                },
                {
                    "start": 528.52,
                    "end": 528.68,
                    "word": " other",
                    "probability": 0.76171875
                },
                {
                    "start": 528.68,
                    "end": 529.0,
                    "word": " hand",
                    "probability": 0.80078125
                },
                {
                    "start": 529.0,
                    "end": 530.02,
                    "word": ",",
                    "probability": 0.9326171875
                },
                {
                    "start": 530.02,
                    "end": 530.32,
                    "word": " in",
                    "probability": 0.87939453125
                },
                {
                    "start": 530.32,
                    "end": 530.4,
                    "word": " the",
                    "probability": 0.8115234375
                },
                {
                    "start": 530.4,
                    "end": 530.64,
                    "word": " native",
                    "probability": 0.7177734375
                },
                {
                    "start": 530.64,
                    "end": 531.04,
                    "word": " code",
                    "probability": 0.79052734375
                },
                {
                    "start": 531.04,
                    "end": 531.38,
                    "word": ",",
                    "probability": 0.80029296875
                },
                {
                    "start": 531.38,
                    "end": 531.48,
                    "word": " this",
                    "probability": 0.75830078125
                },
                {
                    "start": 531.48,
                    "end": 531.88,
                    "word": " DLL",
                    "probability": 0.9599609375
                },
                {
                    "start": 531.88,
                    "end": 532.42,
                    "word": " main",
                    "probability": 0.50732421875
                },
                {
                    "start": 532.42,
                    "end": 532.96,
                    "word": " dispatcher",
                    "probability": 0.781005859375
                },
                {
                    "start": 532.96,
                    "end": 533.38,
                    "word": " spent",
                    "probability": 0.241943359375
                },
                {
                    "start": 534.08,
                    "end": 534.34,
                    "word": " a reverse",
                    "probability": 0.67626953125
                },
                {
                    "start": 534.34,
                    "end": 534.58,
                    "word": " shell",
                    "probability": 0.8017578125
                },
                {
                    "start": 534.58,
                    "end": 534.96,
                    "word": " connected",
                    "probability": 0.65966796875
                },
                {
                    "start": 534.96,
                    "end": 535.14,
                    "word": " to",
                    "probability": 0.89892578125
                },
                {
                    "start": 535.14,
                    "end": 535.28,
                    "word": " the",
                    "probability": 0.7275390625
                },
                {
                    "start": 535.28,
                    "end": 535.56,
                    "word": " attacker",
                    "probability": 0.73828125
                },
                {
                    "start": 535.56,
                    "end": 536.26,
                    "word": ".",
                    "probability": 0.9345703125
                }
            ]
        },
        {
            "id": 107,
            "seek": 54532,
            "start": 536.26,
            "end": 540.64,
            "text": " And as I mentioned, there were more similar DLL files.",
            "tokens": [
                51064,
                400,
                382,
                286,
                2835,
                11,
                456,
                645,
                544,
                2531,
                413,
                24010,
                7098,
                13,
                51264
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2157315310429443,
            "compression_ratio": 1.5545454545454545,
            "no_speech_prob": 0.01152801513671875,
            "words": [
                {
                    "start": 536.26,
                    "end": 536.36,
                    "word": " And",
                    "probability": 0.6630859375
                },
                {
                    "start": 536.36,
                    "end": 536.48,
                    "word": " as",
                    "probability": 0.8515625
                },
                {
                    "start": 536.48,
                    "end": 536.66,
                    "word": " I",
                    "probability": 0.99755859375
                },
                {
                    "start": 536.66,
                    "end": 537.1,
                    "word": " mentioned",
                    "probability": 0.7529296875
                },
                {
                    "start": 537.1,
                    "end": 537.6,
                    "word": ",",
                    "probability": 0.95849609375
                },
                {
                    "start": 537.6,
                    "end": 537.74,
                    "word": " there",
                    "probability": 0.8544921875
                },
                {
                    "start": 537.74,
                    "end": 538.0,
                    "word": " were",
                    "probability": 0.76416015625
                },
                {
                    "start": 538.0,
                    "end": 538.36,
                    "word": " more",
                    "probability": 0.8798828125
                },
                {
                    "start": 538.36,
                    "end": 538.76,
                    "word": " similar",
                    "probability": 0.92333984375
                },
                {
                    "start": 538.76,
                    "end": 539.16,
                    "word": " DLL",
                    "probability": 0.969970703125
                },
                {
                    "start": 539.16,
                    "end": 540.42,
                    "word": " files",
                    "probability": 0.798828125
                },
                {
                    "start": 540.42,
                    "end": 540.64,
                    "word": ".",
                    "probability": 0.693359375
                }
            ]
        },
        {
            "id": 108,
            "seek": 54532,
            "start": 540.64,
            "end": 548.98,
            "text": " However, these files differs only in two strings, which contained the original file name of DLL.",
            "tokens": [
                51264,
                2908,
                11,
                613,
                7098,
                37761,
                787,
                294,
                732,
                13985,
                11,
                597,
                16212,
                264,
                3380,
                3991,
                1315,
                295,
                413,
                24010,
                13,
                51714
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2157315310429443,
            "compression_ratio": 1.5545454545454545,
            "no_speech_prob": 0.01152801513671875,
            "words": [
                {
                    "start": 540.64,
                    "end": 540.96,
                    "word": " However",
                    "probability": 0.8359375
                },
                {
                    "start": 540.96,
                    "end": 541.38,
                    "word": ",",
                    "probability": 0.9814453125
                },
                {
                    "start": 541.38,
                    "end": 541.58,
                    "word": " these",
                    "probability": 0.57763671875
                },
                {
                    "start": 541.58,
                    "end": 542.0,
                    "word": " files",
                    "probability": 0.830078125
                },
                {
                    "start": 542.0,
                    "end": 542.46,
                    "word": " differs",
                    "probability": 0.4228515625
                },
                {
                    "start": 542.46,
                    "end": 542.86,
                    "word": " only",
                    "probability": 0.85546875
                },
                {
                    "start": 542.86,
                    "end": 543.24,
                    "word": " in",
                    "probability": 0.90380859375
                },
                {
                    "start": 543.24,
                    "end": 543.82,
                    "word": " two",
                    "probability": 0.7802734375
                },
                {
                    "start": 543.82,
                    "end": 544.28,
                    "word": " strings",
                    "probability": 0.75634765625
                },
                {
                    "start": 544.28,
                    "end": 544.98,
                    "word": ",",
                    "probability": 0.564453125
                },
                {
                    "start": 544.98,
                    "end": 545.32,
                    "word": " which",
                    "probability": 0.90380859375
                },
                {
                    "start": 545.32,
                    "end": 545.8,
                    "word": " contained",
                    "probability": 0.5927734375
                },
                {
                    "start": 545.8,
                    "end": 546.14,
                    "word": " the",
                    "probability": 0.8193359375
                },
                {
                    "start": 546.14,
                    "end": 546.58,
                    "word": " original",
                    "probability": 0.86474609375
                },
                {
                    "start": 546.58,
                    "end": 546.9,
                    "word": " file",
                    "probability": 0.5771484375
                },
                {
                    "start": 546.9,
                    "end": 547.2,
                    "word": " name",
                    "probability": 0.8095703125
                },
                {
                    "start": 547.2,
                    "end": 548.02,
                    "word": " of",
                    "probability": 0.90380859375
                },
                {
                    "start": 548.02,
                    "end": 548.38,
                    "word": " DLL",
                    "probability": 0.896240234375
                },
                {
                    "start": 548.38,
                    "end": 548.98,
                    "word": ".",
                    "probability": 0.90625
                }
            ]
        },
        {
            "id": 109,
            "seek": 57268,
            "start": 548.98,
            "end": 555.98,
            "text": " So nothing, no significant differences in the functionality of these files.",
            "tokens": [
                50364,
                407,
                1825,
                11,
                572,
                4776,
                7300,
                294,
                264,
                14980,
                295,
                613,
                7098,
                13,
                50714
            ],
            "temperature": 0.0,
            "avg_logprob": -0.26207387338985094,
            "compression_ratio": 1.3846153846153846,
            "no_speech_prob": 0.022247314453125,
            "words": [
                {
                    "start": 548.98,
                    "end": 549.22,
                    "word": " So",
                    "probability": 0.521484375
                },
                {
                    "start": 549.22,
                    "end": 549.72,
                    "word": " nothing",
                    "probability": 0.2252197265625
                },
                {
                    "start": 549.72,
                    "end": 550.28,
                    "word": ",",
                    "probability": 0.68505859375
                },
                {
                    "start": 550.28,
                    "end": 550.42,
                    "word": " no",
                    "probability": 0.8994140625
                },
                {
                    "start": 550.42,
                    "end": 551.08,
                    "word": " significant",
                    "probability": 0.73779296875
                },
                {
                    "start": 551.08,
                    "end": 552.4,
                    "word": " differences",
                    "probability": 0.64892578125
                },
                {
                    "start": 552.4,
                    "end": 553.36,
                    "word": " in",
                    "probability": 0.888671875
                },
                {
                    "start": 553.36,
                    "end": 553.56,
                    "word": " the",
                    "probability": 0.80810546875
                },
                {
                    "start": 553.56,
                    "end": 554.0,
                    "word": " functionality",
                    "probability": 0.90625
                },
                {
                    "start": 554.0,
                    "end": 554.3,
                    "word": " of",
                    "probability": 0.90576171875
                },
                {
                    "start": 554.3,
                    "end": 554.56,
                    "word": " these",
                    "probability": 0.6708984375
                },
                {
                    "start": 554.56,
                    "end": 554.98,
                    "word": " files",
                    "probability": 0.82861328125
                },
                {
                    "start": 554.98,
                    "end": 555.98,
                    "word": ".",
                    "probability": 0.9453125
                }
            ]
        },
        {
            "id": 110,
            "seek": 57268,
            "start": 556.36,
            "end": 570.68,
            "text": " With the suspicion that this could be payload delivered after the exploitation of ASP.NET vulnerability because of IIS worker process,",
            "tokens": [
                50714,
                2022,
                264,
                32020,
                300,
                341,
                727,
                312,
                30918,
                10144,
                934,
                264,
                33122,
                295,
                7469,
                47,
                13,
                35554,
                24210,
                570,
                295,
                286,
                2343,
                11346,
                1399,
                11,
                51464
            ],
            "temperature": 0.0,
            "avg_logprob": -0.26207387338985094,
            "compression_ratio": 1.3846153846153846,
            "no_speech_prob": 0.022247314453125,
            "words": [
                {
                    "start": 556.36,
                    "end": 556.8,
                    "word": " With",
                    "probability": 0.8525390625
                },
                {
                    "start": 556.8,
                    "end": 556.98,
                    "word": " the",
                    "probability": 0.7822265625
                },
                {
                    "start": 556.98,
                    "end": 557.38,
                    "word": " suspicion",
                    "probability": 0.8896484375
                },
                {
                    "start": 557.38,
                    "end": 558.68,
                    "word": " that",
                    "probability": 0.85205078125
                },
                {
                    "start": 558.68,
                    "end": 559.48,
                    "word": " this",
                    "probability": 0.8662109375
                },
                {
                    "start": 559.48,
                    "end": 559.7,
                    "word": " could",
                    "probability": 0.810546875
                },
                {
                    "start": 559.7,
                    "end": 560.18,
                    "word": " be",
                    "probability": 0.908203125
                },
                {
                    "start": 560.18,
                    "end": 561.6,
                    "word": " payload",
                    "probability": 0.73828125
                },
                {
                    "start": 561.6,
                    "end": 562.18,
                    "word": " delivered",
                    "probability": 0.63134765625
                },
                {
                    "start": 562.18,
                    "end": 562.62,
                    "word": " after",
                    "probability": 0.7177734375
                },
                {
                    "start": 562.62,
                    "end": 562.84,
                    "word": " the",
                    "probability": 0.7919921875
                },
                {
                    "start": 562.84,
                    "end": 563.34,
                    "word": " exploitation",
                    "probability": 0.7685546875
                },
                {
                    "start": 563.34,
                    "end": 564.08,
                    "word": " of",
                    "probability": 0.89453125
                },
                {
                    "start": 564.08,
                    "end": 564.64,
                    "word": " ASP",
                    "probability": 0.6878662109375
                },
                {
                    "start": 564.64,
                    "end": 564.96,
                    "word": ".NET",
                    "probability": 0.927734375
                },
                {
                    "start": 564.96,
                    "end": 565.58,
                    "word": " vulnerability",
                    "probability": 0.81787109375
                },
                {
                    "start": 565.58,
                    "end": 566.44,
                    "word": " because",
                    "probability": 0.587890625
                },
                {
                    "start": 566.44,
                    "end": 567.02,
                    "word": " of",
                    "probability": 0.8974609375
                },
                {
                    "start": 567.02,
                    "end": 567.88,
                    "word": " IIS",
                    "probability": 0.863525390625
                },
                {
                    "start": 567.88,
                    "end": 569.08,
                    "word": " worker",
                    "probability": 0.49658203125
                },
                {
                    "start": 569.08,
                    "end": 569.56,
                    "word": " process",
                    "probability": 0.82763671875
                },
                {
                    "start": 569.56,
                    "end": 570.68,
                    "word": ",",
                    "probability": 0.72314453125
                }
            ]
        },
        {
            "id": 111,
            "seek": 57268,
            "start": 570.68,
            "end": 576.34,
            "text": " we tried to find something more about it.",
            "tokens": [
                51464,
                321,
                3031,
                281,
                915,
                746,
                544,
                466,
                309,
                13,
                51764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.26207387338985094,
            "compression_ratio": 1.3846153846153846,
            "no_speech_prob": 0.022247314453125,
            "words": [
                {
                    "start": 570.68,
                    "end": 571.62,
                    "word": " we",
                    "probability": 0.8916015625
                },
                {
                    "start": 571.62,
                    "end": 571.88,
                    "word": " tried",
                    "probability": 0.37646484375
                },
                {
                    "start": 571.88,
                    "end": 572.14,
                    "word": " to",
                    "probability": 0.90673828125
                },
                {
                    "start": 572.14,
                    "end": 572.7,
                    "word": " find",
                    "probability": 0.82373046875
                },
                {
                    "start": 572.7,
                    "end": 574.38,
                    "word": " something",
                    "probability": 0.74072265625
                },
                {
                    "start": 574.38,
                    "end": 574.68,
                    "word": " more",
                    "probability": 0.87451171875
                },
                {
                    "start": 574.68,
                    "end": 575.04,
                    "word": " about",
                    "probability": 0.822265625
                },
                {
                    "start": 575.04,
                    "end": 575.34,
                    "word": " it",
                    "probability": 0.90283203125
                },
                {
                    "start": 575.34,
                    "end": 576.34,
                    "word": ".",
                    "probability": 0.84765625
                }
            ]
        },
        {
            "id": 112,
            "seek": 60082,
            "start": 577.26,
            "end": 589.54,
            "text": " With the similarity in original build name, DLL names, it was easy to leverage the thread intelligence and found the particular vulnerability and the tool, which produces the same DLLs.",
            "tokens": [
                50414,
                2022,
                264,
                32194,
                294,
                3380,
                1322,
                1315,
                11,
                413,
                24010,
                5288,
                11,
                309,
                390,
                1858,
                281,
                13982,
                264,
                7207,
                7599,
                293,
                1352,
                264,
                1729,
                24210,
                293,
                264,
                2290,
                11,
                597,
                14725,
                264,
                912,
                413,
                24010,
                82,
                13,
                51014
            ],
            "temperature": 0.0,
            "avg_logprob": -0.27529762259551455,
            "compression_ratio": 1.5355648535564854,
            "no_speech_prob": 0.1016845703125,
            "words": [
                {
                    "start": 577.26,
                    "end": 577.98,
                    "word": " With",
                    "probability": 0.69677734375
                },
                {
                    "start": 577.98,
                    "end": 578.4,
                    "word": " the",
                    "probability": 0.78564453125
                },
                {
                    "start": 578.4,
                    "end": 578.88,
                    "word": " similarity",
                    "probability": 0.85107421875
                },
                {
                    "start": 578.88,
                    "end": 579.36,
                    "word": " in",
                    "probability": 0.89404296875
                },
                {
                    "start": 579.36,
                    "end": 580.08,
                    "word": " original",
                    "probability": 0.50732421875
                },
                {
                    "start": 580.08,
                    "end": 580.4,
                    "word": " build",
                    "probability": 0.73486328125
                },
                {
                    "start": 580.4,
                    "end": 580.76,
                    "word": " name",
                    "probability": 0.471435546875
                },
                {
                    "start": 580.76,
                    "end": 580.92,
                    "word": ",",
                    "probability": 0.623046875
                },
                {
                    "start": 580.92,
                    "end": 581.16,
                    "word": " DLL",
                    "probability": 0.790771484375
                },
                {
                    "start": 581.16,
                    "end": 581.54,
                    "word": " names",
                    "probability": 0.73681640625
                },
                {
                    "start": 581.54,
                    "end": 581.82,
                    "word": ",",
                    "probability": 0.876953125
                },
                {
                    "start": 581.82,
                    "end": 581.9,
                    "word": " it",
                    "probability": 0.86083984375
                },
                {
                    "start": 581.9,
                    "end": 582.02,
                    "word": " was",
                    "probability": 0.88427734375
                },
                {
                    "start": 582.02,
                    "end": 582.28,
                    "word": " easy",
                    "probability": 0.814453125
                },
                {
                    "start": 582.28,
                    "end": 582.46,
                    "word": " to",
                    "probability": 0.90625
                },
                {
                    "start": 582.46,
                    "end": 582.82,
                    "word": " leverage",
                    "probability": 0.7041015625
                },
                {
                    "start": 582.82,
                    "end": 583.16,
                    "word": " the",
                    "probability": 0.8125
                },
                {
                    "start": 583.16,
                    "end": 583.38,
                    "word": " thread",
                    "probability": 0.489013671875
                },
                {
                    "start": 583.38,
                    "end": 583.92,
                    "word": " intelligence",
                    "probability": 0.69677734375
                },
                {
                    "start": 583.92,
                    "end": 584.16,
                    "word": " and",
                    "probability": 0.85888671875
                },
                {
                    "start": 584.16,
                    "end": 584.52,
                    "word": " found",
                    "probability": 0.90380859375
                },
                {
                    "start": 584.52,
                    "end": 585.1,
                    "word": " the",
                    "probability": 0.79833984375
                },
                {
                    "start": 585.1,
                    "end": 585.52,
                    "word": " particular",
                    "probability": 0.80908203125
                },
                {
                    "start": 585.52,
                    "end": 586.1,
                    "word": " vulnerability",
                    "probability": 0.85693359375
                },
                {
                    "start": 586.1,
                    "end": 586.58,
                    "word": " and",
                    "probability": 0.81689453125
                },
                {
                    "start": 586.58,
                    "end": 586.74,
                    "word": " the",
                    "probability": 0.80517578125
                },
                {
                    "start": 586.74,
                    "end": 587.1,
                    "word": " tool",
                    "probability": 0.80126953125
                },
                {
                    "start": 587.1,
                    "end": 587.5,
                    "word": ",",
                    "probability": 0.2626953125
                },
                {
                    "start": 587.5,
                    "end": 587.7,
                    "word": " which",
                    "probability": 0.91943359375
                },
                {
                    "start": 587.7,
                    "end": 588.14,
                    "word": " produces",
                    "probability": 0.5263671875
                },
                {
                    "start": 588.14,
                    "end": 588.4,
                    "word": " the",
                    "probability": 0.8076171875
                },
                {
                    "start": 588.4,
                    "end": 588.6,
                    "word": " same",
                    "probability": 0.80126953125
                },
                {
                    "start": 588.6,
                    "end": 589.18,
                    "word": " DLLs",
                    "probability": 0.9534505208333334
                },
                {
                    "start": 589.18,
                    "end": 589.54,
                    "word": ".",
                    "probability": 0.99462890625
                }
            ]
        },
        {
            "id": 113,
            "seek": 60082,
            "start": 590.2,
            "end": 600.64,
            "text": " It turns out that these files had been part of remote code execution exploit for vulnerability in Telerik web user interface for ASP.NET.",
            "tokens": [
                51014,
                467,
                4523,
                484,
                300,
                613,
                7098,
                632,
                668,
                644,
                295,
                8607,
                3089,
                15058,
                25924,
                337,
                24210,
                294,
                27729,
                260,
                1035,
                3670,
                4195,
                9226,
                337,
                7469,
                47,
                13,
                35554,
                13,
                51564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.27529762259551455,
            "compression_ratio": 1.5355648535564854,
            "no_speech_prob": 0.1016845703125,
            "words": [
                {
                    "start": 590.2,
                    "end": 590.42,
                    "word": " It",
                    "probability": 0.89697265625
                },
                {
                    "start": 590.42,
                    "end": 590.72,
                    "word": " turns",
                    "probability": 0.77197265625
                },
                {
                    "start": 590.72,
                    "end": 591.02,
                    "word": " out",
                    "probability": 0.81494140625
                },
                {
                    "start": 591.02,
                    "end": 591.22,
                    "word": " that",
                    "probability": 0.861328125
                },
                {
                    "start": 591.22,
                    "end": 591.62,
                    "word": " these",
                    "probability": 0.68603515625
                },
                {
                    "start": 591.62,
                    "end": 592.02,
                    "word": " files",
                    "probability": 0.83837890625
                },
                {
                    "start": 592.02,
                    "end": 592.26,
                    "word": " had",
                    "probability": 0.66015625
                },
                {
                    "start": 592.26,
                    "end": 592.44,
                    "word": " been",
                    "probability": 0.81591796875
                },
                {
                    "start": 592.44,
                    "end": 592.78,
                    "word": " part",
                    "probability": 0.814453125
                },
                {
                    "start": 592.78,
                    "end": 593.06,
                    "word": " of",
                    "probability": 0.908203125
                },
                {
                    "start": 593.06,
                    "end": 593.48,
                    "word": " remote",
                    "probability": 0.363525390625
                },
                {
                    "start": 593.48,
                    "end": 593.76,
                    "word": " code",
                    "probability": 0.54248046875
                },
                {
                    "start": 593.76,
                    "end": 594.22,
                    "word": " execution",
                    "probability": 0.8427734375
                },
                {
                    "start": 594.22,
                    "end": 594.78,
                    "word": " exploit",
                    "probability": 0.41748046875
                },
                {
                    "start": 594.78,
                    "end": 595.16,
                    "word": " for",
                    "probability": 0.86474609375
                },
                {
                    "start": 595.16,
                    "end": 595.7,
                    "word": " vulnerability",
                    "probability": 0.65576171875
                },
                {
                    "start": 595.7,
                    "end": 596.38,
                    "word": " in",
                    "probability": 0.8935546875
                },
                {
                    "start": 596.38,
                    "end": 597.24,
                    "word": " Telerik",
                    "probability": 0.5985514322916666
                },
                {
                    "start": 597.24,
                    "end": 597.5,
                    "word": " web",
                    "probability": 0.615234375
                },
                {
                    "start": 597.5,
                    "end": 597.7,
                    "word": " user",
                    "probability": 0.72998046875
                },
                {
                    "start": 597.7,
                    "end": 598.3,
                    "word": " interface",
                    "probability": 0.76513671875
                },
                {
                    "start": 598.3,
                    "end": 598.72,
                    "word": " for",
                    "probability": 0.62109375
                },
                {
                    "start": 598.72,
                    "end": 599.5,
                    "word": " ASP",
                    "probability": 0.85107421875
                },
                {
                    "start": 599.5,
                    "end": 599.92,
                    "word": ".NET",
                    "probability": 0.885009765625
                },
                {
                    "start": 599.92,
                    "end": 600.64,
                    "word": ".",
                    "probability": 0.978515625
                }
            ]
        },
        {
            "id": 114,
            "seek": 60082,
            "start": 600.94,
            "end": 604.48,
            "text": " This exploit can be found on GitHub, again.",
            "tokens": [
                51564,
                639,
                25924,
                393,
                312,
                1352,
                322,
                23331,
                11,
                797,
                13,
                51764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.27529762259551455,
            "compression_ratio": 1.5355648535564854,
            "no_speech_prob": 0.1016845703125,
            "words": [
                {
                    "start": 600.94,
                    "end": 601.18,
                    "word": " This",
                    "probability": 0.79736328125
                },
                {
                    "start": 601.18,
                    "end": 601.74,
                    "word": " exploit",
                    "probability": 0.845703125
                },
                {
                    "start": 601.74,
                    "end": 602.12,
                    "word": " can",
                    "probability": 0.8916015625
                },
                {
                    "start": 602.12,
                    "end": 602.26,
                    "word": " be",
                    "probability": 0.9091796875
                },
                {
                    "start": 602.26,
                    "end": 602.56,
                    "word": " found",
                    "probability": 0.88525390625
                },
                {
                    "start": 602.56,
                    "end": 602.78,
                    "word": " on",
                    "probability": 0.9013671875
                },
                {
                    "start": 602.78,
                    "end": 603.0,
                    "word": " GitHub",
                    "probability": 0.8896484375
                },
                {
                    "start": 603.0,
                    "end": 603.38,
                    "word": ",",
                    "probability": 0.421875
                },
                {
                    "start": 603.38,
                    "end": 603.76,
                    "word": " again",
                    "probability": 0.90869140625
                },
                {
                    "start": 603.76,
                    "end": 604.48,
                    "word": ".",
                    "probability": 0.658203125
                }
            ]
        },
        {
            "id": 115,
            "seek": 62900,
            "start": 604.48,
            "end": 616.76,
            "text": " And after review, it was clear that this tool was used for building the DLLs with the reverse shell we just discovered.",
            "tokens": [
                50364,
                400,
                934,
                3131,
                11,
                309,
                390,
                1850,
                300,
                341,
                2290,
                390,
                1143,
                337,
                2390,
                264,
                413,
                24010,
                82,
                365,
                264,
                9943,
                8720,
                321,
                445,
                6941,
                13,
                50964
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2283653846153846,
            "compression_ratio": 1.5101010101010102,
            "no_speech_prob": 0.0146942138671875,
            "words": [
                {
                    "start": 604.48,
                    "end": 604.88,
                    "word": " And",
                    "probability": 0.324462890625
                },
                {
                    "start": 604.88,
                    "end": 605.22,
                    "word": " after",
                    "probability": 0.7353515625
                },
                {
                    "start": 605.22,
                    "end": 605.6,
                    "word": " review",
                    "probability": 0.2464599609375
                },
                {
                    "start": 605.6,
                    "end": 606.36,
                    "word": ",",
                    "probability": 0.70849609375
                },
                {
                    "start": 606.36,
                    "end": 606.72,
                    "word": " it",
                    "probability": 0.89404296875
                },
                {
                    "start": 606.72,
                    "end": 607.04,
                    "word": " was",
                    "probability": 0.89404296875
                },
                {
                    "start": 607.04,
                    "end": 607.38,
                    "word": " clear",
                    "probability": 0.81884765625
                },
                {
                    "start": 607.38,
                    "end": 607.62,
                    "word": " that",
                    "probability": 0.8642578125
                },
                {
                    "start": 607.62,
                    "end": 607.88,
                    "word": " this",
                    "probability": 0.875
                },
                {
                    "start": 607.88,
                    "end": 608.14,
                    "word": " tool",
                    "probability": 0.84716796875
                },
                {
                    "start": 608.14,
                    "end": 608.46,
                    "word": " was",
                    "probability": 0.88916015625
                },
                {
                    "start": 608.46,
                    "end": 608.86,
                    "word": " used",
                    "probability": 0.80615234375
                },
                {
                    "start": 608.86,
                    "end": 609.44,
                    "word": " for",
                    "probability": 0.8916015625
                },
                {
                    "start": 609.44,
                    "end": 609.8,
                    "word": " building",
                    "probability": 0.78857421875
                },
                {
                    "start": 609.8,
                    "end": 610.08,
                    "word": " the",
                    "probability": 0.818359375
                },
                {
                    "start": 610.08,
                    "end": 610.74,
                    "word": " DLLs",
                    "probability": 0.943359375
                },
                {
                    "start": 610.74,
                    "end": 611.1,
                    "word": " with",
                    "probability": 0.79443359375
                },
                {
                    "start": 611.1,
                    "end": 612.9,
                    "word": " the",
                    "probability": 0.6064453125
                },
                {
                    "start": 612.9,
                    "end": 614.16,
                    "word": " reverse",
                    "probability": 0.8193359375
                },
                {
                    "start": 614.16,
                    "end": 614.56,
                    "word": " shell",
                    "probability": 0.685546875
                },
                {
                    "start": 614.56,
                    "end": 615.14,
                    "word": " we",
                    "probability": 0.86083984375
                },
                {
                    "start": 615.14,
                    "end": 615.5,
                    "word": " just",
                    "probability": 0.8642578125
                },
                {
                    "start": 615.5,
                    "end": 616.0,
                    "word": " discovered",
                    "probability": 0.615234375
                },
                {
                    "start": 616.0,
                    "end": 616.76,
                    "word": ".",
                    "probability": 0.97412109375
                }
            ]
        },
        {
            "id": 116,
            "seek": 62900,
            "start": 617.0,
            "end": 624.02,
            "text": " So we find the origin of this tool and also the initial letter of compromise.",
            "tokens": [
                50964,
                407,
                321,
                915,
                264,
                4957,
                295,
                341,
                2290,
                293,
                611,
                264,
                5883,
                5063,
                295,
                18577,
                13,
                51364
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2283653846153846,
            "compression_ratio": 1.5101010101010102,
            "no_speech_prob": 0.0146942138671875,
            "words": [
                {
                    "start": 617.0,
                    "end": 617.4,
                    "word": " So",
                    "probability": 0.88330078125
                },
                {
                    "start": 617.4,
                    "end": 617.6,
                    "word": " we",
                    "probability": 0.70654296875
                },
                {
                    "start": 617.6,
                    "end": 617.88,
                    "word": " find",
                    "probability": 0.78515625
                },
                {
                    "start": 617.88,
                    "end": 618.08,
                    "word": " the",
                    "probability": 0.8056640625
                },
                {
                    "start": 618.08,
                    "end": 618.4,
                    "word": " origin",
                    "probability": 0.76611328125
                },
                {
                    "start": 618.4,
                    "end": 618.88,
                    "word": " of",
                    "probability": 0.9033203125
                },
                {
                    "start": 618.88,
                    "end": 620.62,
                    "word": " this",
                    "probability": 0.7509765625
                },
                {
                    "start": 620.62,
                    "end": 620.92,
                    "word": " tool",
                    "probability": 0.84423828125
                },
                {
                    "start": 620.92,
                    "end": 621.16,
                    "word": " and",
                    "probability": 0.76025390625
                },
                {
                    "start": 621.16,
                    "end": 621.58,
                    "word": " also",
                    "probability": 0.82275390625
                },
                {
                    "start": 621.58,
                    "end": 622.06,
                    "word": " the",
                    "probability": 0.8037109375
                },
                {
                    "start": 622.06,
                    "end": 622.32,
                    "word": " initial",
                    "probability": 0.88525390625
                },
                {
                    "start": 622.32,
                    "end": 622.62,
                    "word": " letter",
                    "probability": 0.58837890625
                },
                {
                    "start": 622.62,
                    "end": 622.86,
                    "word": " of",
                    "probability": 0.9111328125
                },
                {
                    "start": 622.86,
                    "end": 623.26,
                    "word": " compromise",
                    "probability": 0.7080078125
                },
                {
                    "start": 623.26,
                    "end": 624.02,
                    "word": ".",
                    "probability": 0.9892578125
                }
            ]
        },
        {
            "id": 117,
            "seek": 62900,
            "start": 625.58,
            "end": 632.66,
            "text": " Further investigation and hunting for other persistence methods revealed the WMI event subscriptions.",
            "tokens": [
                51364,
                15364,
                9627,
                293,
                12599,
                337,
                661,
                37617,
                7150,
                9599,
                264,
                343,
                13808,
                2280,
                44951,
                13,
                51764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2283653846153846,
            "compression_ratio": 1.5101010101010102,
            "no_speech_prob": 0.0146942138671875,
            "words": [
                {
                    "start": 625.58,
                    "end": 625.94,
                    "word": " Further",
                    "probability": 0.90185546875
                },
                {
                    "start": 625.94,
                    "end": 626.56,
                    "word": " investigation",
                    "probability": 0.68798828125
                },
                {
                    "start": 626.56,
                    "end": 627.32,
                    "word": " and",
                    "probability": 0.8798828125
                },
                {
                    "start": 627.32,
                    "end": 627.64,
                    "word": " hunting",
                    "probability": 0.82470703125
                },
                {
                    "start": 627.64,
                    "end": 628.02,
                    "word": " for",
                    "probability": 0.896484375
                },
                {
                    "start": 628.02,
                    "end": 628.3,
                    "word": " other",
                    "probability": 0.755859375
                },
                {
                    "start": 628.3,
                    "end": 628.7,
                    "word": " persistence",
                    "probability": 0.71044921875
                },
                {
                    "start": 628.7,
                    "end": 629.24,
                    "word": " methods",
                    "probability": 0.81396484375
                },
                {
                    "start": 629.24,
                    "end": 630.06,
                    "word": " revealed",
                    "probability": 0.896484375
                },
                {
                    "start": 630.06,
                    "end": 630.38,
                    "word": " the",
                    "probability": 0.80810546875
                },
                {
                    "start": 630.38,
                    "end": 631.02,
                    "word": " WMI",
                    "probability": 0.966064453125
                },
                {
                    "start": 631.02,
                    "end": 631.32,
                    "word": " event",
                    "probability": 0.68115234375
                },
                {
                    "start": 631.32,
                    "end": 631.9,
                    "word": " subscriptions",
                    "probability": 0.5986328125
                },
                {
                    "start": 631.9,
                    "end": 632.66,
                    "word": ".",
                    "probability": 0.9755859375
                }
            ]
        },
        {
            "id": 118,
            "seek": 65006,
            "start": 632.66,
            "end": 639.66,
            "text": " The attackers registered the event filter and consumer and also the filter to consumer binding.",
            "tokens": [
                50364,
                440,
                45129,
                13968,
                264,
                2280,
                6608,
                293,
                9711,
                293,
                611,
                264,
                6608,
                281,
                9711,
                17359,
                13,
                50714
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2753314330722346,
            "compression_ratio": 1.5614973262032086,
            "no_speech_prob": 0.0123138427734375,
            "words": [
                {
                    "start": 632.66,
                    "end": 633.16,
                    "word": " The",
                    "probability": 0.40576171875
                },
                {
                    "start": 633.16,
                    "end": 633.5,
                    "word": " attackers",
                    "probability": 0.50146484375
                },
                {
                    "start": 633.5,
                    "end": 634.32,
                    "word": " registered",
                    "probability": 0.63623046875
                },
                {
                    "start": 634.32,
                    "end": 634.78,
                    "word": " the",
                    "probability": 0.74609375
                },
                {
                    "start": 634.78,
                    "end": 635.08,
                    "word": " event",
                    "probability": 0.701171875
                },
                {
                    "start": 635.08,
                    "end": 635.44,
                    "word": " filter",
                    "probability": 0.876953125
                },
                {
                    "start": 635.44,
                    "end": 635.98,
                    "word": " and",
                    "probability": 0.79296875
                },
                {
                    "start": 635.98,
                    "end": 636.72,
                    "word": " consumer",
                    "probability": 0.44384765625
                },
                {
                    "start": 636.72,
                    "end": 637.38,
                    "word": " and",
                    "probability": 0.6005859375
                },
                {
                    "start": 637.38,
                    "end": 637.66,
                    "word": " also",
                    "probability": 0.796875
                },
                {
                    "start": 637.66,
                    "end": 637.86,
                    "word": " the",
                    "probability": 0.79736328125
                },
                {
                    "start": 637.86,
                    "end": 638.06,
                    "word": " filter",
                    "probability": 0.904296875
                },
                {
                    "start": 638.06,
                    "end": 638.26,
                    "word": " to",
                    "probability": 0.7490234375
                },
                {
                    "start": 638.26,
                    "end": 638.62,
                    "word": " consumer",
                    "probability": 0.626953125
                },
                {
                    "start": 638.62,
                    "end": 639.02,
                    "word": " binding",
                    "probability": 0.7861328125
                },
                {
                    "start": 639.02,
                    "end": 639.66,
                    "word": ".",
                    "probability": 0.47216796875
                }
            ]
        },
        {
            "id": 119,
            "seek": 65006,
            "start": 640.08,
            "end": 646.4,
            "text": " And as a result, it executed the same command as we already saw in the DLL files.",
            "tokens": [
                50714,
                400,
                382,
                257,
                1874,
                11,
                309,
                17577,
                264,
                912,
                5622,
                382,
                321,
                1217,
                1866,
                294,
                264,
                413,
                24010,
                7098,
                13,
                51064
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2753314330722346,
            "compression_ratio": 1.5614973262032086,
            "no_speech_prob": 0.0123138427734375,
            "words": [
                {
                    "start": 640.08,
                    "end": 640.18,
                    "word": " And",
                    "probability": 0.7470703125
                },
                {
                    "start": 640.18,
                    "end": 640.4,
                    "word": " as",
                    "probability": 0.8515625
                },
                {
                    "start": 640.52,
                    "end": 640.92,
                    "word": " a result",
                    "probability": 0.81005859375
                },
                {
                    "start": 640.92,
                    "end": 641.62,
                    "word": ",",
                    "probability": 0.78125
                },
                {
                    "start": 641.62,
                    "end": 641.94,
                    "word": " it",
                    "probability": 0.8681640625
                },
                {
                    "start": 641.94,
                    "end": 642.9,
                    "word": " executed",
                    "probability": 0.78271484375
                },
                {
                    "start": 642.9,
                    "end": 643.16,
                    "word": " the",
                    "probability": 0.79931640625
                },
                {
                    "start": 643.16,
                    "end": 643.4,
                    "word": " same",
                    "probability": 0.8212890625
                },
                {
                    "start": 643.4,
                    "end": 643.74,
                    "word": " command",
                    "probability": 0.57763671875
                },
                {
                    "start": 643.74,
                    "end": 643.94,
                    "word": " as",
                    "probability": 0.72802734375
                },
                {
                    "start": 643.94,
                    "end": 644.06,
                    "word": " we",
                    "probability": 0.734375
                },
                {
                    "start": 644.06,
                    "end": 644.28,
                    "word": " already",
                    "probability": 0.6318359375
                },
                {
                    "start": 644.28,
                    "end": 644.62,
                    "word": " saw",
                    "probability": 0.80322265625
                },
                {
                    "start": 644.62,
                    "end": 644.88,
                    "word": " in",
                    "probability": 0.9013671875
                },
                {
                    "start": 644.88,
                    "end": 645.02,
                    "word": " the",
                    "probability": 0.81494140625
                },
                {
                    "start": 645.02,
                    "end": 645.32,
                    "word": " DLL",
                    "probability": 0.877197265625
                },
                {
                    "start": 645.32,
                    "end": 645.76,
                    "word": " files",
                    "probability": 0.78173828125
                },
                {
                    "start": 645.76,
                    "end": 646.4,
                    "word": ".",
                    "probability": 0.99072265625
                }
            ]
        },
        {
            "id": 120,
            "seek": 65006,
            "start": 646.7,
            "end": 653.72,
            "text": " Now, we thought that we were ready to start with remediation and removal the malicious artifacts from the network.",
            "tokens": [
                51064,
                823,
                11,
                321,
                1194,
                300,
                321,
                645,
                1919,
                281,
                722,
                365,
                28718,
                6642,
                293,
                17933,
                264,
                33496,
                24617,
                490,
                264,
                3209,
                13,
                51414
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2753314330722346,
            "compression_ratio": 1.5614973262032086,
            "no_speech_prob": 0.0123138427734375,
            "words": [
                {
                    "start": 646.7,
                    "end": 647.06,
                    "word": " Now",
                    "probability": 0.88916015625
                },
                {
                    "start": 647.06,
                    "end": 647.4,
                    "word": ",",
                    "probability": 0.576171875
                },
                {
                    "start": 647.4,
                    "end": 647.54,
                    "word": " we",
                    "probability": 0.8759765625
                },
                {
                    "start": 647.54,
                    "end": 647.86,
                    "word": " thought",
                    "probability": 0.802734375
                },
                {
                    "start": 647.86,
                    "end": 648.26,
                    "word": " that",
                    "probability": 0.83740234375
                },
                {
                    "start": 648.26,
                    "end": 648.4,
                    "word": " we",
                    "probability": 0.89013671875
                },
                {
                    "start": 648.4,
                    "end": 648.58,
                    "word": " were",
                    "probability": 0.78759765625
                },
                {
                    "start": 648.58,
                    "end": 648.9,
                    "word": " ready",
                    "probability": 0.7900390625
                },
                {
                    "start": 648.9,
                    "end": 649.1,
                    "word": " to",
                    "probability": 0.90625
                },
                {
                    "start": 649.1,
                    "end": 649.4,
                    "word": " start",
                    "probability": 0.8671875
                },
                {
                    "start": 649.4,
                    "end": 649.6,
                    "word": " with",
                    "probability": 0.74609375
                },
                {
                    "start": 649.6,
                    "end": 650.2,
                    "word": " remediation",
                    "probability": 0.864990234375
                },
                {
                    "start": 650.2,
                    "end": 650.56,
                    "word": " and",
                    "probability": 0.88671875
                },
                {
                    "start": 650.56,
                    "end": 650.88,
                    "word": " removal",
                    "probability": 0.69775390625
                },
                {
                    "start": 650.88,
                    "end": 651.5,
                    "word": " the",
                    "probability": 0.36376953125
                },
                {
                    "start": 651.5,
                    "end": 651.76,
                    "word": " malicious",
                    "probability": 0.79150390625
                },
                {
                    "start": 651.76,
                    "end": 652.26,
                    "word": " artifacts",
                    "probability": 0.63916015625
                },
                {
                    "start": 652.26,
                    "end": 652.54,
                    "word": " from",
                    "probability": 0.822265625
                },
                {
                    "start": 652.54,
                    "end": 652.68,
                    "word": " the",
                    "probability": 0.8203125
                },
                {
                    "start": 652.68,
                    "end": 653.08,
                    "word": " network",
                    "probability": 0.84375
                },
                {
                    "start": 653.08,
                    "end": 653.72,
                    "word": ".",
                    "probability": 0.98291015625
                }
            ]
        },
        {
            "id": 121,
            "seek": 67892,
            "start": 653.72,
            "end": 667.16,
            "text": " We developed a custom PowerShell script for detection of all malicious stuff we were aware, including the malicious files and also the persistent artifacts.",
            "tokens": [
                50364,
                492,
                4743,
                257,
                2375,
                7086,
                9526,
                285,
                5755,
                337,
                17784,
                295,
                439,
                33496,
                1507,
                321,
                645,
                3650,
                11,
                3009,
                264,
                33496,
                7098,
                293,
                611,
                264,
                24315,
                24617,
                13,
                51014
            ],
            "temperature": 0.0,
            "avg_logprob": -0.29430649378528334,
            "compression_ratio": 1.5863636363636364,
            "no_speech_prob": 0.397216796875,
            "words": [
                {
                    "start": 653.72,
                    "end": 653.84,
                    "word": " We",
                    "probability": 0.72412109375
                },
                {
                    "start": 653.84,
                    "end": 654.64,
                    "word": " developed",
                    "probability": 0.64892578125
                },
                {
                    "start": 655.68,
                    "end": 655.96,
                    "word": " a custom",
                    "probability": 0.7666015625
                },
                {
                    "start": 655.96,
                    "end": 656.42,
                    "word": " PowerShell",
                    "probability": 0.9114583333333334
                },
                {
                    "start": 656.42,
                    "end": 656.78,
                    "word": " script",
                    "probability": 0.63232421875
                },
                {
                    "start": 656.78,
                    "end": 657.06,
                    "word": " for",
                    "probability": 0.89599609375
                },
                {
                    "start": 657.06,
                    "end": 657.46,
                    "word": " detection",
                    "probability": 0.6044921875
                },
                {
                    "start": 657.46,
                    "end": 658.8,
                    "word": " of",
                    "probability": 0.87646484375
                },
                {
                    "start": 658.8,
                    "end": 659.14,
                    "word": " all",
                    "probability": 0.90380859375
                },
                {
                    "start": 659.14,
                    "end": 659.46,
                    "word": " malicious",
                    "probability": 0.7529296875
                },
                {
                    "start": 659.46,
                    "end": 659.86,
                    "word": " stuff",
                    "probability": 0.82421875
                },
                {
                    "start": 659.86,
                    "end": 659.98,
                    "word": " we",
                    "probability": 0.33349609375
                },
                {
                    "start": 659.98,
                    "end": 660.12,
                    "word": " were",
                    "probability": 0.5576171875
                },
                {
                    "start": 660.12,
                    "end": 660.42,
                    "word": " aware",
                    "probability": 0.576171875
                },
                {
                    "start": 660.42,
                    "end": 660.94,
                    "word": ",",
                    "probability": 0.54931640625
                },
                {
                    "start": 660.94,
                    "end": 661.4,
                    "word": " including",
                    "probability": 0.76220703125
                },
                {
                    "start": 661.4,
                    "end": 661.92,
                    "word": " the",
                    "probability": 0.7734375
                },
                {
                    "start": 661.92,
                    "end": 662.54,
                    "word": " malicious",
                    "probability": 0.76611328125
                },
                {
                    "start": 662.54,
                    "end": 663.5,
                    "word": " files",
                    "probability": 0.595703125
                },
                {
                    "start": 663.5,
                    "end": 664.44,
                    "word": " and",
                    "probability": 0.64599609375
                },
                {
                    "start": 664.44,
                    "end": 664.88,
                    "word": " also",
                    "probability": 0.828125
                },
                {
                    "start": 664.88,
                    "end": 665.16,
                    "word": " the",
                    "probability": 0.806640625
                },
                {
                    "start": 665.16,
                    "end": 665.62,
                    "word": " persistent",
                    "probability": 0.869140625
                },
                {
                    "start": 665.62,
                    "end": 666.36,
                    "word": " artifacts",
                    "probability": 0.81494140625
                },
                {
                    "start": 666.36,
                    "end": 667.16,
                    "word": ".",
                    "probability": 0.99560546875
                }
            ]
        },
        {
            "id": 122,
            "seek": 67892,
            "start": 667.34,
            "end": 674.2,
            "text": " Then we deployed our scripts throughout EDR solution and there was a big surprise.",
            "tokens": [
                51014,
                1396,
                321,
                17826,
                527,
                23294,
                3710,
                462,
                9301,
                3827,
                293,
                456,
                390,
                257,
                955,
                6365,
                13,
                51364
            ],
            "temperature": 0.0,
            "avg_logprob": -0.29430649378528334,
            "compression_ratio": 1.5863636363636364,
            "no_speech_prob": 0.397216796875,
            "words": [
                {
                    "start": 667.34,
                    "end": 667.88,
                    "word": " Then",
                    "probability": 0.8046875
                },
                {
                    "start": 667.88,
                    "end": 668.14,
                    "word": " we",
                    "probability": 0.69482421875
                },
                {
                    "start": 668.14,
                    "end": 668.5,
                    "word": " deployed",
                    "probability": 0.779296875
                },
                {
                    "start": 668.5,
                    "end": 668.78,
                    "word": " our",
                    "probability": 0.82177734375
                },
                {
                    "start": 668.78,
                    "end": 669.12,
                    "word": " scripts",
                    "probability": 0.434326171875
                },
                {
                    "start": 669.12,
                    "end": 669.44,
                    "word": " throughout",
                    "probability": 0.44482421875
                },
                {
                    "start": 669.44,
                    "end": 669.8,
                    "word": " EDR",
                    "probability": 0.93359375
                },
                {
                    "start": 669.8,
                    "end": 670.26,
                    "word": " solution",
                    "probability": 0.7802734375
                },
                {
                    "start": 670.26,
                    "end": 671.18,
                    "word": " and",
                    "probability": 0.468994140625
                },
                {
                    "start": 671.18,
                    "end": 672.48,
                    "word": " there",
                    "probability": 0.80908203125
                },
                {
                    "start": 672.48,
                    "end": 672.66,
                    "word": " was",
                    "probability": 0.8876953125
                },
                {
                    "start": 672.8,
                    "end": 672.96,
                    "word": " a big",
                    "probability": 0.890625
                },
                {
                    "start": 672.96,
                    "end": 673.52,
                    "word": " surprise",
                    "probability": 0.72900390625
                },
                {
                    "start": 673.52,
                    "end": 674.2,
                    "word": ".",
                    "probability": 0.91796875
                }
            ]
        },
        {
            "id": 123,
            "seek": 67892,
            "start": 674.2,
            "end": 682.58,
            "text": " EDR fired alert that there were detected attempts to install persistence for malicious DLLs we already known.",
            "tokens": [
                51364,
                462,
                9301,
                11777,
                9615,
                300,
                456,
                645,
                21896,
                15257,
                281,
                3625,
                37617,
                337,
                33496,
                413,
                24010,
                82,
                321,
                1217,
                2570,
                13,
                51814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.29430649378528334,
            "compression_ratio": 1.5863636363636364,
            "no_speech_prob": 0.397216796875,
            "words": [
                {
                    "start": 674.2,
                    "end": 674.48,
                    "word": " EDR",
                    "probability": 0.9677734375
                },
                {
                    "start": 674.48,
                    "end": 675.0,
                    "word": " fired",
                    "probability": 0.599609375
                },
                {
                    "start": 675.0,
                    "end": 675.48,
                    "word": " alert",
                    "probability": 0.62548828125
                },
                {
                    "start": 675.48,
                    "end": 676.12,
                    "word": " that",
                    "probability": 0.8232421875
                },
                {
                    "start": 676.12,
                    "end": 676.32,
                    "word": " there",
                    "probability": 0.8271484375
                },
                {
                    "start": 676.32,
                    "end": 676.5,
                    "word": " were",
                    "probability": 0.8671875
                },
                {
                    "start": 676.5,
                    "end": 676.82,
                    "word": " detected",
                    "probability": 0.68701171875
                },
                {
                    "start": 676.82,
                    "end": 677.32,
                    "word": " attempts",
                    "probability": 0.69921875
                },
                {
                    "start": 677.32,
                    "end": 677.72,
                    "word": " to",
                    "probability": 0.90625
                },
                {
                    "start": 677.72,
                    "end": 678.24,
                    "word": " install",
                    "probability": 0.8564453125
                },
                {
                    "start": 678.24,
                    "end": 679.24,
                    "word": " persistence",
                    "probability": 0.806640625
                },
                {
                    "start": 679.24,
                    "end": 679.64,
                    "word": " for",
                    "probability": 0.78759765625
                },
                {
                    "start": 679.64,
                    "end": 680.12,
                    "word": " malicious",
                    "probability": 0.8037109375
                },
                {
                    "start": 680.12,
                    "end": 681.2,
                    "word": " DLLs",
                    "probability": 0.9573567708333334
                },
                {
                    "start": 681.2,
                    "end": 681.5,
                    "word": " we",
                    "probability": 0.58544921875
                },
                {
                    "start": 681.5,
                    "end": 682.04,
                    "word": " already",
                    "probability": 0.7626953125
                },
                {
                    "start": 682.04,
                    "end": 682.38,
                    "word": " known",
                    "probability": 0.25244140625
                },
                {
                    "start": 682.38,
                    "end": 682.58,
                    "word": ".",
                    "probability": 0.98828125
                }
            ]
        },
        {
            "id": 124,
            "seek": 70824,
            "start": 682.58,
            "end": 691.64,
            "text": " So, we investigated those alerts and we found that those commands had been spawned by PowerShell process.",
            "tokens": [
                50364,
                407,
                11,
                321,
                30070,
                729,
                28061,
                293,
                321,
                1352,
                300,
                729,
                16901,
                632,
                668,
                17088,
                292,
                538,
                7086,
                9526,
                285,
                1399,
                13,
                50814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2280159849067067,
            "compression_ratio": 1.5964125560538116,
            "no_speech_prob": 0.020965576171875,
            "words": [
                {
                    "start": 682.58,
                    "end": 683.88,
                    "word": " So",
                    "probability": 0.78662109375
                },
                {
                    "start": 683.88,
                    "end": 684.84,
                    "word": ",",
                    "probability": 0.5947265625
                },
                {
                    "start": 684.84,
                    "end": 685.28,
                    "word": " we",
                    "probability": 0.88916015625
                },
                {
                    "start": 685.28,
                    "end": 685.96,
                    "word": " investigated",
                    "probability": 0.76220703125
                },
                {
                    "start": 685.96,
                    "end": 686.3,
                    "word": " those",
                    "probability": 0.7861328125
                },
                {
                    "start": 686.3,
                    "end": 686.68,
                    "word": " alerts",
                    "probability": 0.83740234375
                },
                {
                    "start": 686.68,
                    "end": 687.2,
                    "word": " and",
                    "probability": 0.57861328125
                },
                {
                    "start": 687.2,
                    "end": 687.36,
                    "word": " we",
                    "probability": 0.80615234375
                },
                {
                    "start": 687.36,
                    "end": 687.66,
                    "word": " found",
                    "probability": 0.88232421875
                },
                {
                    "start": 687.66,
                    "end": 687.98,
                    "word": " that",
                    "probability": 0.75
                },
                {
                    "start": 687.98,
                    "end": 688.64,
                    "word": " those",
                    "probability": 0.83984375
                },
                {
                    "start": 688.64,
                    "end": 689.06,
                    "word": " commands",
                    "probability": 0.802734375
                },
                {
                    "start": 689.06,
                    "end": 689.28,
                    "word": " had",
                    "probability": 0.75439453125
                },
                {
                    "start": 689.28,
                    "end": 689.52,
                    "word": " been",
                    "probability": 0.83642578125
                },
                {
                    "start": 689.52,
                    "end": 690.12,
                    "word": " spawned",
                    "probability": 0.76025390625
                },
                {
                    "start": 690.12,
                    "end": 690.4,
                    "word": " by",
                    "probability": 0.9052734375
                },
                {
                    "start": 690.4,
                    "end": 690.86,
                    "word": " PowerShell",
                    "probability": 0.84765625
                },
                {
                    "start": 690.86,
                    "end": 691.28,
                    "word": " process",
                    "probability": 0.80322265625
                },
                {
                    "start": 691.28,
                    "end": 691.64,
                    "word": ".",
                    "probability": 0.78271484375
                }
            ]
        },
        {
            "id": 125,
            "seek": 70824,
            "start": 692.18,
            "end": 697.96,
            "text": " Actually, the PowerShell process associated with our removal script.",
            "tokens": [
                50814,
                5135,
                11,
                264,
                7086,
                9526,
                285,
                1399,
                6615,
                365,
                527,
                17933,
                5755,
                13,
                51114
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2280159849067067,
            "compression_ratio": 1.5964125560538116,
            "no_speech_prob": 0.020965576171875,
            "words": [
                {
                    "start": 692.18,
                    "end": 692.98,
                    "word": " Actually",
                    "probability": 0.794921875
                },
                {
                    "start": 692.98,
                    "end": 693.76,
                    "word": ",",
                    "probability": 0.87548828125
                },
                {
                    "start": 693.76,
                    "end": 694.06,
                    "word": " the",
                    "probability": 0.79541015625
                },
                {
                    "start": 694.06,
                    "end": 694.56,
                    "word": " PowerShell",
                    "probability": 0.9324544270833334
                },
                {
                    "start": 694.56,
                    "end": 694.96,
                    "word": " process",
                    "probability": 0.84814453125
                },
                {
                    "start": 694.96,
                    "end": 695.58,
                    "word": " associated",
                    "probability": 0.748046875
                },
                {
                    "start": 695.58,
                    "end": 696.36,
                    "word": " with",
                    "probability": 0.80126953125
                },
                {
                    "start": 696.36,
                    "end": 696.78,
                    "word": " our",
                    "probability": 0.80615234375
                },
                {
                    "start": 696.78,
                    "end": 697.14,
                    "word": " removal",
                    "probability": 0.66796875
                },
                {
                    "start": 697.14,
                    "end": 697.56,
                    "word": " script",
                    "probability": 0.7783203125
                },
                {
                    "start": 697.56,
                    "end": 697.96,
                    "word": ".",
                    "probability": 0.9638671875
                }
            ]
        },
        {
            "id": 126,
            "seek": 70824,
            "start": 698.22,
            "end": 701.18,
            "text": " What? What the hell is this?",
            "tokens": [
                51114,
                708,
                30,
                708,
                264,
                4921,
                307,
                341,
                30,
                51264
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2280159849067067,
            "compression_ratio": 1.5964125560538116,
            "no_speech_prob": 0.020965576171875,
            "words": [
                {
                    "start": 698.22,
                    "end": 698.72,
                    "word": " What",
                    "probability": 0.80615234375
                },
                {
                    "start": 698.72,
                    "end": 699.12,
                    "word": "?",
                    "probability": 0.69287109375
                },
                {
                    "start": 699.12,
                    "end": 699.92,
                    "word": " What",
                    "probability": 0.80224609375
                },
                {
                    "start": 699.92,
                    "end": 700.02,
                    "word": " the",
                    "probability": 0.80126953125
                },
                {
                    "start": 700.02,
                    "end": 700.14,
                    "word": " hell",
                    "probability": 0.78857421875
                },
                {
                    "start": 700.14,
                    "end": 700.32,
                    "word": " is",
                    "probability": 0.90185546875
                },
                {
                    "start": 700.32,
                    "end": 700.58,
                    "word": " this",
                    "probability": 0.8837890625
                },
                {
                    "start": 700.58,
                    "end": 701.18,
                    "word": "?",
                    "probability": 0.98046875
                }
            ]
        },
        {
            "id": 127,
            "seek": 70824,
            "start": 701.18,
            "end": 707.54,
            "text": " We were absolutely sure that our PowerShell script didn't do anything like this.",
            "tokens": [
                51264,
                492,
                645,
                3122,
                988,
                300,
                527,
                7086,
                9526,
                285,
                5755,
                994,
                380,
                360,
                1340,
                411,
                341,
                13,
                51564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2280159849067067,
            "compression_ratio": 1.5964125560538116,
            "no_speech_prob": 0.020965576171875,
            "words": [
                {
                    "start": 701.18,
                    "end": 701.42,
                    "word": " We",
                    "probability": 0.408935546875
                },
                {
                    "start": 701.42,
                    "end": 701.68,
                    "word": " were",
                    "probability": 0.85009765625
                },
                {
                    "start": 701.68,
                    "end": 702.98,
                    "word": " absolutely",
                    "probability": 0.6923828125
                },
                {
                    "start": 702.98,
                    "end": 703.62,
                    "word": " sure",
                    "probability": 0.79541015625
                },
                {
                    "start": 703.62,
                    "end": 704.38,
                    "word": " that",
                    "probability": 0.84814453125
                },
                {
                    "start": 704.38,
                    "end": 704.72,
                    "word": " our",
                    "probability": 0.81396484375
                },
                {
                    "start": 704.72,
                    "end": 705.22,
                    "word": " PowerShell",
                    "probability": 0.9368489583333334
                },
                {
                    "start": 705.22,
                    "end": 705.56,
                    "word": " script",
                    "probability": 0.66015625
                },
                {
                    "start": 705.56,
                    "end": 705.98,
                    "word": " didn't",
                    "probability": 0.92138671875
                },
                {
                    "start": 705.98,
                    "end": 706.18,
                    "word": " do",
                    "probability": 0.90673828125
                },
                {
                    "start": 706.18,
                    "end": 706.5,
                    "word": " anything",
                    "probability": 0.8486328125
                },
                {
                    "start": 706.5,
                    "end": 706.82,
                    "word": " like",
                    "probability": 0.8828125
                },
                {
                    "start": 706.82,
                    "end": 707.08,
                    "word": " this",
                    "probability": 0.88134765625
                },
                {
                    "start": 707.08,
                    "end": 707.54,
                    "word": ".",
                    "probability": 0.9521484375
                }
            ]
        },
        {
            "id": 128,
            "seek": 70824,
            "start": 707.54,
            "end": 711.9,
            "text": " Its purpose was to remove malicious persistence, not to create new one.",
            "tokens": [
                51564,
                6953,
                4334,
                390,
                281,
                4159,
                33496,
                37617,
                11,
                406,
                281,
                1884,
                777,
                472,
                13,
                51814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2280159849067067,
            "compression_ratio": 1.5964125560538116,
            "no_speech_prob": 0.020965576171875,
            "words": [
                {
                    "start": 707.54,
                    "end": 707.7,
                    "word": " Its",
                    "probability": 0.66845703125
                },
                {
                    "start": 707.7,
                    "end": 707.98,
                    "word": " purpose",
                    "probability": 0.68701171875
                },
                {
                    "start": 707.98,
                    "end": 708.38,
                    "word": " was",
                    "probability": 0.89892578125
                },
                {
                    "start": 708.38,
                    "end": 708.52,
                    "word": " to",
                    "probability": 0.89990234375
                },
                {
                    "start": 708.52,
                    "end": 708.96,
                    "word": " remove",
                    "probability": 0.8447265625
                },
                {
                    "start": 708.96,
                    "end": 709.4,
                    "word": " malicious",
                    "probability": 0.81787109375
                },
                {
                    "start": 709.4,
                    "end": 709.96,
                    "word": " persistence",
                    "probability": 0.6318359375
                },
                {
                    "start": 709.96,
                    "end": 710.32,
                    "word": ",",
                    "probability": 0.8271484375
                },
                {
                    "start": 710.32,
                    "end": 710.78,
                    "word": " not",
                    "probability": 0.89404296875
                },
                {
                    "start": 710.78,
                    "end": 710.98,
                    "word": " to",
                    "probability": 0.9033203125
                },
                {
                    "start": 710.98,
                    "end": 711.24,
                    "word": " create",
                    "probability": 0.84521484375
                },
                {
                    "start": 711.24,
                    "end": 711.44,
                    "word": " new",
                    "probability": 0.474853515625
                },
                {
                    "start": 711.44,
                    "end": 711.72,
                    "word": " one",
                    "probability": 0.7529296875
                },
                {
                    "start": 711.72,
                    "end": 711.9,
                    "word": ".",
                    "probability": 0.9833984375
                }
            ]
        },
        {
            "id": 129,
            "seek": 73000,
            "start": 711.9,
            "end": 721.56,
            "text": " Yet we tested our script in our lab and also our client tested the script in their environment and nothing similar was observed.",
            "tokens": [
                50364,
                10890,
                321,
                8246,
                527,
                5755,
                294,
                527,
                2715,
                293,
                611,
                527,
                6423,
                8246,
                264,
                5755,
                294,
                641,
                2823,
                293,
                1825,
                2531,
                390,
                13095,
                13,
                50814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.20617676340043545,
            "compression_ratio": 1.581151832460733,
            "no_speech_prob": 0.0233612060546875,
            "words": [
                {
                    "start": 711.9,
                    "end": 712.82,
                    "word": " Yet",
                    "probability": 0.580078125
                },
                {
                    "start": 712.82,
                    "end": 713.0,
                    "word": " we",
                    "probability": 0.6708984375
                },
                {
                    "start": 713.0,
                    "end": 713.3,
                    "word": " tested",
                    "probability": 0.81884765625
                },
                {
                    "start": 713.3,
                    "end": 713.72,
                    "word": " our",
                    "probability": 0.7958984375
                },
                {
                    "start": 713.72,
                    "end": 714.06,
                    "word": " script",
                    "probability": 0.7421875
                },
                {
                    "start": 714.06,
                    "end": 714.24,
                    "word": " in",
                    "probability": 0.8984375
                },
                {
                    "start": 714.24,
                    "end": 714.52,
                    "word": " our",
                    "probability": 0.81494140625
                },
                {
                    "start": 714.52,
                    "end": 714.8,
                    "word": " lab",
                    "probability": 0.89599609375
                },
                {
                    "start": 714.8,
                    "end": 715.32,
                    "word": " and",
                    "probability": 0.521484375
                },
                {
                    "start": 715.32,
                    "end": 715.62,
                    "word": " also",
                    "probability": 0.7373046875
                },
                {
                    "start": 715.62,
                    "end": 715.88,
                    "word": " our",
                    "probability": 0.8193359375
                },
                {
                    "start": 715.88,
                    "end": 716.26,
                    "word": " client",
                    "probability": 0.48193359375
                },
                {
                    "start": 716.26,
                    "end": 716.6,
                    "word": " tested",
                    "probability": 0.71728515625
                },
                {
                    "start": 716.6,
                    "end": 716.84,
                    "word": " the",
                    "probability": 0.53515625
                },
                {
                    "start": 716.84,
                    "end": 717.1,
                    "word": " script",
                    "probability": 0.783203125
                },
                {
                    "start": 717.1,
                    "end": 717.38,
                    "word": " in",
                    "probability": 0.89892578125
                },
                {
                    "start": 717.38,
                    "end": 717.68,
                    "word": " their",
                    "probability": 0.8984375
                },
                {
                    "start": 717.68,
                    "end": 718.18,
                    "word": " environment",
                    "probability": 0.771484375
                },
                {
                    "start": 718.18,
                    "end": 718.88,
                    "word": " and",
                    "probability": 0.5869140625
                },
                {
                    "start": 718.88,
                    "end": 719.2,
                    "word": " nothing",
                    "probability": 0.8330078125
                },
                {
                    "start": 719.2,
                    "end": 719.78,
                    "word": " similar",
                    "probability": 0.89599609375
                },
                {
                    "start": 719.78,
                    "end": 720.26,
                    "word": " was",
                    "probability": 0.86669921875
                },
                {
                    "start": 720.26,
                    "end": 720.9,
                    "word": " observed",
                    "probability": 0.7412109375
                },
                {
                    "start": 720.9,
                    "end": 721.56,
                    "word": ".",
                    "probability": 0.96484375
                }
            ]
        },
        {
            "id": 130,
            "seek": 73000,
            "start": 721.88,
            "end": 725.21,
            "text": " Hence, there was only one possible explanation of this.",
            "tokens": [
                50814,
                22229,
                11,
                456,
                390,
                787,
                472,
                1944,
                10835,
                295,
                341,
                13,
                51014
            ],
            "temperature": 0.0,
            "avg_logprob": -0.20617676340043545,
            "compression_ratio": 1.581151832460733,
            "no_speech_prob": 0.0233612060546875,
            "words": [
                {
                    "start": 721.88,
                    "end": 722.46,
                    "word": " Hence",
                    "probability": 0.8505859375
                },
                {
                    "start": 722.46,
                    "end": 722.64,
                    "word": ",",
                    "probability": 0.6748046875
                },
                {
                    "start": 722.64,
                    "end": 722.78,
                    "word": " there",
                    "probability": 0.84521484375
                },
                {
                    "start": 722.78,
                    "end": 722.94,
                    "word": " was",
                    "probability": 0.87255859375
                },
                {
                    "start": 722.94,
                    "end": 723.16,
                    "word": " only",
                    "probability": 0.84912109375
                },
                {
                    "start": 723.16,
                    "end": 723.46,
                    "word": " one",
                    "probability": 0.80615234375
                },
                {
                    "start": 723.46,
                    "end": 723.82,
                    "word": " possible",
                    "probability": 0.8837890625
                },
                {
                    "start": 723.82,
                    "end": 724.32,
                    "word": " explanation",
                    "probability": 0.76318359375
                },
                {
                    "start": 724.32,
                    "end": 724.62,
                    "word": " of",
                    "probability": 0.8505859375
                },
                {
                    "start": 724.62,
                    "end": 724.88,
                    "word": " this",
                    "probability": 0.8740234375
                },
                {
                    "start": 724.88,
                    "end": 725.21,
                    "word": ".",
                    "probability": 0.93505859375
                }
            ]
        },
        {
            "id": 131,
            "seek": 73000,
            "start": 726.1,
            "end": 730.7,
            "text": " The attacker established another persistence method we did not find yet.",
            "tokens": [
                51014,
                440,
                35871,
                7545,
                1071,
                37617,
                3170,
                321,
                630,
                406,
                915,
                1939,
                13,
                51264
            ],
            "temperature": 0.0,
            "avg_logprob": -0.20617676340043545,
            "compression_ratio": 1.581151832460733,
            "no_speech_prob": 0.0233612060546875,
            "words": [
                {
                    "start": 726.1,
                    "end": 726.22,
                    "word": " The",
                    "probability": 0.53515625
                },
                {
                    "start": 726.22,
                    "end": 726.44,
                    "word": " attacker",
                    "probability": 0.7099609375
                },
                {
                    "start": 726.44,
                    "end": 727.22,
                    "word": " established",
                    "probability": 0.841796875
                },
                {
                    "start": 727.22,
                    "end": 727.9,
                    "word": " another",
                    "probability": 0.8369140625
                },
                {
                    "start": 727.9,
                    "end": 728.32,
                    "word": " persistence",
                    "probability": 0.80322265625
                },
                {
                    "start": 728.32,
                    "end": 728.8,
                    "word": " method",
                    "probability": 0.84521484375
                },
                {
                    "start": 728.8,
                    "end": 729.26,
                    "word": " we",
                    "probability": 0.81201171875
                },
                {
                    "start": 729.26,
                    "end": 729.42,
                    "word": " did",
                    "probability": 0.88232421875
                },
                {
                    "start": 729.42,
                    "end": 729.6,
                    "word": " not",
                    "probability": 0.90283203125
                },
                {
                    "start": 729.6,
                    "end": 729.92,
                    "word": " find",
                    "probability": 0.82666015625
                },
                {
                    "start": 729.92,
                    "end": 730.22,
                    "word": " yet",
                    "probability": 0.88671875
                },
                {
                    "start": 730.22,
                    "end": 730.7,
                    "word": ".",
                    "probability": 0.79443359375
                }
            ]
        },
        {
            "id": 132,
            "seek": 73000,
            "start": 730.7,
            "end": 733.66,
            "text": " Therefore, another investigation was needed.",
            "tokens": [
                51264,
                7504,
                11,
                1071,
                9627,
                390,
                2978,
                13,
                51414
            ],
            "temperature": 0.0,
            "avg_logprob": -0.20617676340043545,
            "compression_ratio": 1.581151832460733,
            "no_speech_prob": 0.0233612060546875,
            "words": [
                {
                    "start": 730.7,
                    "end": 731.1,
                    "word": " Therefore",
                    "probability": 0.66357421875
                },
                {
                    "start": 731.1,
                    "end": 731.64,
                    "word": ",",
                    "probability": 0.89599609375
                },
                {
                    "start": 731.64,
                    "end": 731.94,
                    "word": " another",
                    "probability": 0.81640625
                },
                {
                    "start": 731.94,
                    "end": 732.4,
                    "word": " investigation",
                    "probability": 0.69775390625
                },
                {
                    "start": 732.4,
                    "end": 732.74,
                    "word": " was",
                    "probability": 0.89306640625
                },
                {
                    "start": 732.74,
                    "end": 733.0,
                    "word": " needed",
                    "probability": 0.70849609375
                },
                {
                    "start": 733.0,
                    "end": 733.66,
                    "word": ".",
                    "probability": 0.99072265625
                }
            ]
        },
        {
            "id": 133,
            "seek": 75422,
            "start": 733.66,
            "end": 743.66,
            "text": " After a while, we found that the malicious DLL is loaded into the PowerShell process shortly after it queried the registry for specific class ID.",
            "tokens": [
                50364,
                2381,
                257,
                1339,
                11,
                321,
                1352,
                300,
                264,
                33496,
                413,
                24010,
                307,
                13210,
                666,
                264,
                7086,
                9526,
                285,
                1399,
                13392,
                934,
                309,
                7083,
                1091,
                264,
                36468,
                337,
                2685,
                1508,
                7348,
                13,
                50864
            ],
            "temperature": 0.0,
            "avg_logprob": -0.18803879070556026,
            "compression_ratio": 1.6227272727272728,
            "no_speech_prob": 0.3818359375,
            "words": [
                {
                    "start": 733.66,
                    "end": 734.14,
                    "word": " After",
                    "probability": 0.67431640625
                },
                {
                    "start": 734.28,
                    "end": 734.5,
                    "word": " a while",
                    "probability": 0.91650390625
                },
                {
                    "start": 734.5,
                    "end": 734.7,
                    "word": ",",
                    "probability": 0.73193359375
                },
                {
                    "start": 734.7,
                    "end": 734.82,
                    "word": " we",
                    "probability": 0.8955078125
                },
                {
                    "start": 734.82,
                    "end": 735.12,
                    "word": " found",
                    "probability": 0.876953125
                },
                {
                    "start": 735.12,
                    "end": 735.3,
                    "word": " that",
                    "probability": 0.82763671875
                },
                {
                    "start": 735.3,
                    "end": 735.48,
                    "word": " the",
                    "probability": 0.783203125
                },
                {
                    "start": 735.48,
                    "end": 735.7,
                    "word": " malicious",
                    "probability": 0.68701171875
                },
                {
                    "start": 735.7,
                    "end": 736.04,
                    "word": " DLL",
                    "probability": 0.92041015625
                },
                {
                    "start": 736.04,
                    "end": 736.9,
                    "word": " is",
                    "probability": 0.85693359375
                },
                {
                    "start": 736.9,
                    "end": 737.16,
                    "word": " loaded",
                    "probability": 0.74560546875
                },
                {
                    "start": 737.16,
                    "end": 737.54,
                    "word": " into",
                    "probability": 0.7177734375
                },
                {
                    "start": 737.54,
                    "end": 737.76,
                    "word": " the",
                    "probability": 0.8046875
                },
                {
                    "start": 737.76,
                    "end": 738.08,
                    "word": " PowerShell",
                    "probability": 0.91650390625
                },
                {
                    "start": 738.08,
                    "end": 738.52,
                    "word": " process",
                    "probability": 0.7734375
                },
                {
                    "start": 738.52,
                    "end": 738.88,
                    "word": " shortly",
                    "probability": 0.83740234375
                },
                {
                    "start": 738.88,
                    "end": 739.22,
                    "word": " after",
                    "probability": 0.72119140625
                },
                {
                    "start": 739.22,
                    "end": 739.6,
                    "word": " it",
                    "probability": 0.86181640625
                },
                {
                    "start": 739.6,
                    "end": 740.86,
                    "word": " queried",
                    "probability": 0.7354736328125
                },
                {
                    "start": 740.86,
                    "end": 741.1,
                    "word": " the",
                    "probability": 0.80810546875
                },
                {
                    "start": 741.1,
                    "end": 741.46,
                    "word": " registry",
                    "probability": 0.8671875
                },
                {
                    "start": 741.46,
                    "end": 741.94,
                    "word": " for",
                    "probability": 0.900390625
                },
                {
                    "start": 741.94,
                    "end": 742.44,
                    "word": " specific",
                    "probability": 0.35107421875
                },
                {
                    "start": 742.44,
                    "end": 742.76,
                    "word": " class",
                    "probability": 0.84765625
                },
                {
                    "start": 742.76,
                    "end": 743.06,
                    "word": " ID",
                    "probability": 0.71337890625
                },
                {
                    "start": 743.06,
                    "end": 743.66,
                    "word": ".",
                    "probability": 0.58251953125
                }
            ]
        },
        {
            "id": 134,
            "seek": 75422,
            "start": 743.74,
            "end": 747.74,
            "text": " And this class ID pointed to one of the malicious DLL files.",
            "tokens": [
                50864,
                400,
                341,
                1508,
                7348,
                10932,
                281,
                472,
                295,
                264,
                33496,
                413,
                24010,
                7098,
                13,
                51064
            ],
            "temperature": 0.0,
            "avg_logprob": -0.18803879070556026,
            "compression_ratio": 1.6227272727272728,
            "no_speech_prob": 0.3818359375,
            "words": [
                {
                    "start": 743.74,
                    "end": 743.88,
                    "word": " And",
                    "probability": 0.6689453125
                },
                {
                    "start": 743.88,
                    "end": 744.04,
                    "word": " this",
                    "probability": 0.849609375
                },
                {
                    "start": 744.04,
                    "end": 744.3,
                    "word": " class",
                    "probability": 0.93701171875
                },
                {
                    "start": 744.3,
                    "end": 744.64,
                    "word": " ID",
                    "probability": 0.9267578125
                },
                {
                    "start": 744.64,
                    "end": 745.16,
                    "word": " pointed",
                    "probability": 0.7744140625
                },
                {
                    "start": 745.16,
                    "end": 745.44,
                    "word": " to",
                    "probability": 0.90087890625
                },
                {
                    "start": 745.44,
                    "end": 745.7,
                    "word": " one",
                    "probability": 0.810546875
                },
                {
                    "start": 745.7,
                    "end": 745.88,
                    "word": " of",
                    "probability": 0.9033203125
                },
                {
                    "start": 745.88,
                    "end": 746.02,
                    "word": " the",
                    "probability": 0.81689453125
                },
                {
                    "start": 746.02,
                    "end": 746.28,
                    "word": " malicious",
                    "probability": 0.76318359375
                },
                {
                    "start": 746.28,
                    "end": 746.62,
                    "word": " DLL",
                    "probability": 0.946533203125
                },
                {
                    "start": 746.62,
                    "end": 747.14,
                    "word": " files",
                    "probability": 0.78662109375
                },
                {
                    "start": 747.14,
                    "end": 747.74,
                    "word": ".",
                    "probability": 0.9892578125
                }
            ]
        },
        {
            "id": 135,
            "seek": 75422,
            "start": 748.06,
            "end": 750.98,
            "text": " Okay, but now there is another question.",
            "tokens": [
                51064,
                1033,
                11,
                457,
                586,
                456,
                307,
                1071,
                1168,
                13,
                51214
            ],
            "temperature": 0.0,
            "avg_logprob": -0.18803879070556026,
            "compression_ratio": 1.6227272727272728,
            "no_speech_prob": 0.3818359375,
            "words": [
                {
                    "start": 748.06,
                    "end": 748.34,
                    "word": " Okay",
                    "probability": 0.576171875
                },
                {
                    "start": 748.34,
                    "end": 748.58,
                    "word": ",",
                    "probability": 0.79541015625
                },
                {
                    "start": 748.58,
                    "end": 748.82,
                    "word": " but",
                    "probability": 0.8916015625
                },
                {
                    "start": 748.82,
                    "end": 749.24,
                    "word": " now",
                    "probability": 0.8837890625
                },
                {
                    "start": 749.24,
                    "end": 749.52,
                    "word": " there",
                    "probability": 0.7158203125
                },
                {
                    "start": 749.52,
                    "end": 749.64,
                    "word": " is",
                    "probability": 0.88623046875
                },
                {
                    "start": 749.64,
                    "end": 749.9,
                    "word": " another",
                    "probability": 0.81884765625
                },
                {
                    "start": 749.9,
                    "end": 750.38,
                    "word": " question",
                    "probability": 0.802734375
                },
                {
                    "start": 750.38,
                    "end": 750.98,
                    "word": ".",
                    "probability": 0.74462890625
                }
            ]
        },
        {
            "id": 136,
            "seek": 75422,
            "start": 750.98,
            "end": 755.02,
            "text": " Why PowerShell was interested in this malicious class ID?",
            "tokens": [
                51214,
                1545,
                7086,
                9526,
                285,
                390,
                3102,
                294,
                341,
                33496,
                1508,
                7348,
                30,
                51414
            ],
            "temperature": 0.0,
            "avg_logprob": -0.18803879070556026,
            "compression_ratio": 1.6227272727272728,
            "no_speech_prob": 0.3818359375,
            "words": [
                {
                    "start": 750.98,
                    "end": 751.18,
                    "word": " Why",
                    "probability": 0.81396484375
                },
                {
                    "start": 751.18,
                    "end": 751.76,
                    "word": " PowerShell",
                    "probability": 0.9080403645833334
                },
                {
                    "start": 751.76,
                    "end": 752.04,
                    "word": " was",
                    "probability": 0.884765625
                },
                {
                    "start": 752.04,
                    "end": 752.52,
                    "word": " interested",
                    "probability": 0.6806640625
                },
                {
                    "start": 752.52,
                    "end": 753.28,
                    "word": " in",
                    "probability": 0.904296875
                },
                {
                    "start": 753.28,
                    "end": 753.48,
                    "word": " this",
                    "probability": 0.826171875
                },
                {
                    "start": 753.48,
                    "end": 753.74,
                    "word": " malicious",
                    "probability": 0.80224609375
                },
                {
                    "start": 753.74,
                    "end": 754.08,
                    "word": " class",
                    "probability": 0.9287109375
                },
                {
                    "start": 754.08,
                    "end": 754.42,
                    "word": " ID",
                    "probability": 0.9296875
                },
                {
                    "start": 754.42,
                    "end": 755.02,
                    "word": "?",
                    "probability": 0.94775390625
                }
            ]
        },
        {
            "id": 137,
            "seek": 75422,
            "start": 755.1,
            "end": 757.88,
            "text": " The answer was hidden in the environment variables.",
            "tokens": [
                51414,
                440,
                1867,
                390,
                7633,
                294,
                264,
                2823,
                9102,
                13,
                51564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.18803879070556026,
            "compression_ratio": 1.6227272727272728,
            "no_speech_prob": 0.3818359375,
            "words": [
                {
                    "start": 755.1,
                    "end": 755.3,
                    "word": " The",
                    "probability": 0.80712890625
                },
                {
                    "start": 755.3,
                    "end": 755.6,
                    "word": " answer",
                    "probability": 0.88330078125
                },
                {
                    "start": 755.6,
                    "end": 755.9,
                    "word": " was",
                    "probability": 0.83203125
                },
                {
                    "start": 755.9,
                    "end": 756.16,
                    "word": " hidden",
                    "probability": 0.5810546875
                },
                {
                    "start": 756.16,
                    "end": 756.42,
                    "word": " in",
                    "probability": 0.90576171875
                },
                {
                    "start": 756.42,
                    "end": 756.52,
                    "word": " the",
                    "probability": 0.78955078125
                },
                {
                    "start": 756.52,
                    "end": 756.88,
                    "word": " environment",
                    "probability": 0.76123046875
                },
                {
                    "start": 756.88,
                    "end": 757.58,
                    "word": " variables",
                    "probability": 0.83837890625
                },
                {
                    "start": 757.58,
                    "end": 757.88,
                    "word": ".",
                    "probability": 0.83154296875
                }
            ]
        },
        {
            "id": 138,
            "seek": 78352,
            "start": 757.88,
            "end": 764.94,
            "text": " Especially, there were two environment variables called core enable profiling and core profiler.",
            "tokens": [
                50364,
                8545,
                11,
                456,
                645,
                732,
                2823,
                9102,
                1219,
                4965,
                9528,
                1740,
                4883,
                293,
                4965,
                1740,
                5441,
                13,
                50714
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21821120415610828,
            "compression_ratio": 1.5298804780876494,
            "no_speech_prob": 0.1893310546875,
            "words": [
                {
                    "start": 757.88,
                    "end": 758.66,
                    "word": " Especially",
                    "probability": 0.26025390625
                },
                {
                    "start": 758.66,
                    "end": 759.4,
                    "word": ",",
                    "probability": 0.64501953125
                },
                {
                    "start": 759.4,
                    "end": 759.46,
                    "word": " there",
                    "probability": 0.7880859375
                },
                {
                    "start": 759.46,
                    "end": 759.68,
                    "word": " were",
                    "probability": 0.7451171875
                },
                {
                    "start": 759.68,
                    "end": 759.9,
                    "word": " two",
                    "probability": 0.78271484375
                },
                {
                    "start": 759.9,
                    "end": 760.34,
                    "word": " environment",
                    "probability": 0.7333984375
                },
                {
                    "start": 760.34,
                    "end": 761.08,
                    "word": " variables",
                    "probability": 0.82666015625
                },
                {
                    "start": 761.08,
                    "end": 761.82,
                    "word": " called",
                    "probability": 0.8115234375
                },
                {
                    "start": 761.82,
                    "end": 762.14,
                    "word": " core",
                    "probability": 0.53515625
                },
                {
                    "start": 762.14,
                    "end": 762.42,
                    "word": " enable",
                    "probability": 0.45361328125
                },
                {
                    "start": 762.42,
                    "end": 763.06,
                    "word": " profiling",
                    "probability": 0.9033203125
                },
                {
                    "start": 763.06,
                    "end": 763.5,
                    "word": " and",
                    "probability": 0.880859375
                },
                {
                    "start": 763.5,
                    "end": 763.76,
                    "word": " core",
                    "probability": 0.83544921875
                },
                {
                    "start": 763.76,
                    "end": 764.28,
                    "word": " profiler",
                    "probability": 0.94189453125
                },
                {
                    "start": 764.28,
                    "end": 764.94,
                    "word": ".",
                    "probability": 0.98193359375
                }
            ]
        },
        {
            "id": 139,
            "seek": 78352,
            "start": 764.94,
            "end": 772.34,
            "text": " They caused that every managed process was connected to the profiler specified by given class ID.",
            "tokens": [
                50714,
                814,
                7008,
                300,
                633,
                6453,
                1399,
                390,
                4582,
                281,
                264,
                1740,
                5441,
                22206,
                538,
                2212,
                1508,
                7348,
                13,
                51064
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21821120415610828,
            "compression_ratio": 1.5298804780876494,
            "no_speech_prob": 0.1893310546875,
            "words": [
                {
                    "start": 764.94,
                    "end": 765.26,
                    "word": " They",
                    "probability": 0.71826171875
                },
                {
                    "start": 765.26,
                    "end": 765.66,
                    "word": " caused",
                    "probability": 0.74951171875
                },
                {
                    "start": 765.66,
                    "end": 766.24,
                    "word": " that",
                    "probability": 0.8681640625
                },
                {
                    "start": 766.24,
                    "end": 766.5,
                    "word": " every",
                    "probability": 0.69921875
                },
                {
                    "start": 766.5,
                    "end": 766.86,
                    "word": " managed",
                    "probability": 0.59033203125
                },
                {
                    "start": 766.86,
                    "end": 767.28,
                    "word": " process",
                    "probability": 0.86083984375
                },
                {
                    "start": 767.28,
                    "end": 767.52,
                    "word": " was",
                    "probability": 0.8837890625
                },
                {
                    "start": 767.52,
                    "end": 767.96,
                    "word": " connected",
                    "probability": 0.72119140625
                },
                {
                    "start": 767.96,
                    "end": 768.96,
                    "word": " to",
                    "probability": 0.849609375
                },
                {
                    "start": 768.96,
                    "end": 769.12,
                    "word": " the",
                    "probability": 0.8173828125
                },
                {
                    "start": 769.12,
                    "end": 769.6,
                    "word": " profiler",
                    "probability": 0.936767578125
                },
                {
                    "start": 769.6,
                    "end": 770.18,
                    "word": " specified",
                    "probability": 0.734375
                },
                {
                    "start": 770.18,
                    "end": 770.68,
                    "word": " by",
                    "probability": 0.90576171875
                },
                {
                    "start": 770.68,
                    "end": 771.0,
                    "word": " given",
                    "probability": 0.625
                },
                {
                    "start": 771.0,
                    "end": 771.3,
                    "word": " class",
                    "probability": 0.8955078125
                },
                {
                    "start": 771.3,
                    "end": 771.58,
                    "word": " ID",
                    "probability": 0.861328125
                },
                {
                    "start": 771.58,
                    "end": 772.34,
                    "word": ".",
                    "probability": 0.6015625
                }
            ]
        },
        {
            "id": 140,
            "seek": 78352,
            "start": 772.5,
            "end": 776.18,
            "text": " So, the attacker misused the profiling of .NET applications.",
            "tokens": [
                51064,
                407,
                11,
                264,
                35871,
                3346,
                4717,
                264,
                1740,
                4883,
                295,
                2411,
                35554,
                5821,
                13,
                51264
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21821120415610828,
            "compression_ratio": 1.5298804780876494,
            "no_speech_prob": 0.1893310546875,
            "words": [
                {
                    "start": 772.5,
                    "end": 772.58,
                    "word": " So",
                    "probability": 0.38525390625
                },
                {
                    "start": 772.58,
                    "end": 773.14,
                    "word": ",",
                    "probability": 0.67529296875
                },
                {
                    "start": 773.14,
                    "end": 773.24,
                    "word": " the",
                    "probability": 0.304931640625
                },
                {
                    "start": 773.24,
                    "end": 773.44,
                    "word": " attacker",
                    "probability": 0.69189453125
                },
                {
                    "start": 773.44,
                    "end": 773.98,
                    "word": " misused",
                    "probability": 0.865478515625
                },
                {
                    "start": 773.98,
                    "end": 774.2,
                    "word": " the",
                    "probability": 0.81396484375
                },
                {
                    "start": 774.2,
                    "end": 774.66,
                    "word": " profiling",
                    "probability": 0.953369140625
                },
                {
                    "start": 774.66,
                    "end": 774.82,
                    "word": " of",
                    "probability": 0.90087890625
                },
                {
                    "start": 774.82,
                    "end": 775.1,
                    "word": " .NET",
                    "probability": 0.8173828125
                },
                {
                    "start": 775.1,
                    "end": 775.8,
                    "word": " applications",
                    "probability": 0.7255859375
                },
                {
                    "start": 775.8,
                    "end": 776.18,
                    "word": ".",
                    "probability": 0.99169921875
                }
            ]
        },
        {
            "id": 141,
            "seek": 78352,
            "start": 776.82,
            "end": 780.72,
            "text": " Great. Another small victory for defenders. Yeah.",
            "tokens": [
                51264,
                3769,
                13,
                3996,
                1359,
                9812,
                337,
                36063,
                13,
                865,
                13,
                51514
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21821120415610828,
            "compression_ratio": 1.5298804780876494,
            "no_speech_prob": 0.1893310546875,
            "words": [
                {
                    "start": 776.82,
                    "end": 777.26,
                    "word": " Great",
                    "probability": 0.85693359375
                },
                {
                    "start": 777.26,
                    "end": 777.86,
                    "word": ".",
                    "probability": 0.7041015625
                },
                {
                    "start": 777.86,
                    "end": 778.16,
                    "word": " Another",
                    "probability": 0.83447265625
                },
                {
                    "start": 778.16,
                    "end": 778.46,
                    "word": " small",
                    "probability": 0.861328125
                },
                {
                    "start": 778.46,
                    "end": 778.76,
                    "word": " victory",
                    "probability": 0.755859375
                },
                {
                    "start": 778.76,
                    "end": 779.0,
                    "word": " for",
                    "probability": 0.90771484375
                },
                {
                    "start": 779.0,
                    "end": 779.42,
                    "word": " defenders",
                    "probability": 0.45361328125
                },
                {
                    "start": 779.42,
                    "end": 779.84,
                    "word": ".",
                    "probability": 0.515625
                },
                {
                    "start": 779.84,
                    "end": 779.96,
                    "word": " Yeah",
                    "probability": 0.53759765625
                },
                {
                    "start": 779.96,
                    "end": 780.72,
                    "word": ".",
                    "probability": 0.97509765625
                }
            ]
        },
        {
            "id": 142,
            "seek": 78352,
            "start": 781.18,
            "end": 787.18,
            "text": " Now, before we continue, let's quickly summarize what we discovered until now.",
            "tokens": [
                51514,
                823,
                11,
                949,
                321,
                2354,
                11,
                718,
                311,
                2661,
                20858,
                437,
                321,
                6941,
                1826,
                586,
                13,
                51814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21821120415610828,
            "compression_ratio": 1.5298804780876494,
            "no_speech_prob": 0.1893310546875,
            "words": [
                {
                    "start": 781.18,
                    "end": 781.52,
                    "word": " Now",
                    "probability": 0.83447265625
                },
                {
                    "start": 781.52,
                    "end": 782.62,
                    "word": ",",
                    "probability": 0.9443359375
                },
                {
                    "start": 782.62,
                    "end": 783.2,
                    "word": " before",
                    "probability": 0.7841796875
                },
                {
                    "start": 783.2,
                    "end": 783.36,
                    "word": " we",
                    "probability": 0.89453125
                },
                {
                    "start": 783.36,
                    "end": 783.82,
                    "word": " continue",
                    "probability": 0.791015625
                },
                {
                    "start": 783.82,
                    "end": 784.14,
                    "word": ",",
                    "probability": 0.9599609375
                },
                {
                    "start": 784.14,
                    "end": 784.38,
                    "word": " let's",
                    "probability": 0.92431640625
                },
                {
                    "start": 784.38,
                    "end": 784.64,
                    "word": " quickly",
                    "probability": 0.8486328125
                },
                {
                    "start": 784.64,
                    "end": 785.2,
                    "word": " summarize",
                    "probability": 0.73779296875
                },
                {
                    "start": 785.2,
                    "end": 785.78,
                    "word": " what",
                    "probability": 0.88037109375
                },
                {
                    "start": 785.78,
                    "end": 785.94,
                    "word": " we",
                    "probability": 0.9033203125
                },
                {
                    "start": 785.94,
                    "end": 786.36,
                    "word": " discovered",
                    "probability": 0.62646484375
                },
                {
                    "start": 786.36,
                    "end": 786.72,
                    "word": " until",
                    "probability": 0.81201171875
                },
                {
                    "start": 786.72,
                    "end": 787.0,
                    "word": " now",
                    "probability": 0.890625
                },
                {
                    "start": 787.0,
                    "end": 787.18,
                    "word": ".",
                    "probability": 0.99658203125
                }
            ]
        },
        {
            "id": 143,
            "seek": 80962,
            "start": 787.18,
            "end": 792.2,
            "text": " We already saw thousands of malware samples from four families.",
            "tokens": [
                50364,
                492,
                1217,
                1866,
                5383,
                295,
                40747,
                10938,
                490,
                1451,
                4466,
                13,
                50614
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22666666388511658,
            "compression_ratio": 1.6228070175438596,
            "no_speech_prob": 0.006061553955078125,
            "words": [
                {
                    "start": 787.18,
                    "end": 787.86,
                    "word": " We",
                    "probability": 0.86962890625
                },
                {
                    "start": 787.86,
                    "end": 788.18,
                    "word": " already",
                    "probability": 0.8173828125
                },
                {
                    "start": 788.18,
                    "end": 788.58,
                    "word": " saw",
                    "probability": 0.798828125
                },
                {
                    "start": 788.58,
                    "end": 789.08,
                    "word": " thousands",
                    "probability": 0.82177734375
                },
                {
                    "start": 789.08,
                    "end": 789.38,
                    "word": " of",
                    "probability": 0.89892578125
                },
                {
                    "start": 789.38,
                    "end": 789.6,
                    "word": " malware",
                    "probability": 0.89111328125
                },
                {
                    "start": 789.6,
                    "end": 789.96,
                    "word": " samples",
                    "probability": 0.7734375
                },
                {
                    "start": 789.96,
                    "end": 790.64,
                    "word": " from",
                    "probability": 0.79541015625
                },
                {
                    "start": 790.64,
                    "end": 790.86,
                    "word": " four",
                    "probability": 0.5078125
                },
                {
                    "start": 790.86,
                    "end": 791.38,
                    "word": " families",
                    "probability": 0.8173828125
                },
                {
                    "start": 791.38,
                    "end": 792.2,
                    "word": ".",
                    "probability": 0.28662109375
                }
            ]
        },
        {
            "id": 144,
            "seek": 80962,
            "start": 792.24,
            "end": 801.18,
            "text": " Coin miners, DLL installers for those coin miners, scheduled task backdoors, and reverse shells delivered after the exploitation.",
            "tokens": [
                50614,
                39054,
                35640,
                11,
                413,
                24010,
                3625,
                433,
                337,
                729,
                11464,
                35640,
                11,
                15678,
                5633,
                646,
                18716,
                11,
                293,
                9943,
                22523,
                10144,
                934,
                264,
                33122,
                13,
                51064
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22666666388511658,
            "compression_ratio": 1.6228070175438596,
            "no_speech_prob": 0.006061553955078125,
            "words": [
                {
                    "start": 792.24,
                    "end": 792.42,
                    "word": " Coin",
                    "probability": 0.796875
                },
                {
                    "start": 792.42,
                    "end": 792.92,
                    "word": " miners",
                    "probability": 0.84033203125
                },
                {
                    "start": 792.92,
                    "end": 793.14,
                    "word": ",",
                    "probability": 0.955078125
                },
                {
                    "start": 793.14,
                    "end": 793.36,
                    "word": " DLL",
                    "probability": 0.760009765625
                },
                {
                    "start": 793.36,
                    "end": 794.06,
                    "word": " installers",
                    "probability": 0.913330078125
                },
                {
                    "start": 794.06,
                    "end": 794.74,
                    "word": " for",
                    "probability": 0.8349609375
                },
                {
                    "start": 794.74,
                    "end": 794.96,
                    "word": " those",
                    "probability": 0.76708984375
                },
                {
                    "start": 794.96,
                    "end": 795.22,
                    "word": " coin",
                    "probability": 0.7958984375
                },
                {
                    "start": 795.22,
                    "end": 795.64,
                    "word": " miners",
                    "probability": 0.9091796875
                },
                {
                    "start": 795.64,
                    "end": 795.96,
                    "word": ",",
                    "probability": 0.916015625
                },
                {
                    "start": 795.96,
                    "end": 796.2,
                    "word": " scheduled",
                    "probability": 0.466064453125
                },
                {
                    "start": 796.2,
                    "end": 796.54,
                    "word": " task",
                    "probability": 0.6064453125
                },
                {
                    "start": 796.54,
                    "end": 797.08,
                    "word": " backdoors",
                    "probability": 0.86572265625
                },
                {
                    "start": 797.08,
                    "end": 797.54,
                    "word": ",",
                    "probability": 0.5341796875
                },
                {
                    "start": 797.54,
                    "end": 797.62,
                    "word": " and",
                    "probability": 0.89208984375
                },
                {
                    "start": 797.62,
                    "end": 798.0,
                    "word": " reverse",
                    "probability": 0.814453125
                },
                {
                    "start": 798.0,
                    "end": 798.38,
                    "word": " shells",
                    "probability": 0.46142578125
                },
                {
                    "start": 798.38,
                    "end": 799.2,
                    "word": " delivered",
                    "probability": 0.4677734375
                },
                {
                    "start": 799.2,
                    "end": 799.64,
                    "word": " after",
                    "probability": 0.74169921875
                },
                {
                    "start": 799.64,
                    "end": 799.84,
                    "word": " the",
                    "probability": 0.7841796875
                },
                {
                    "start": 799.84,
                    "end": 800.36,
                    "word": " exploitation",
                    "probability": 0.796875
                },
                {
                    "start": 800.36,
                    "end": 801.18,
                    "word": ".",
                    "probability": 0.990234375
                }
            ]
        },
        {
            "id": 145,
            "seek": 80962,
            "start": 801.36,
            "end": 806.56,
            "text": " Regarding persistence, we already discovered malicious services and scheduled tasks.",
            "tokens": [
                51064,
                35523,
                37617,
                11,
                321,
                1217,
                6941,
                33496,
                3328,
                293,
                15678,
                9608,
                13,
                51314
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22666666388511658,
            "compression_ratio": 1.6228070175438596,
            "no_speech_prob": 0.006061553955078125,
            "words": [
                {
                    "start": 801.36,
                    "end": 801.78,
                    "word": " Regarding",
                    "probability": 0.78857421875
                },
                {
                    "start": 801.78,
                    "end": 802.22,
                    "word": " persistence",
                    "probability": 0.8125
                },
                {
                    "start": 802.22,
                    "end": 802.54,
                    "word": ",",
                    "probability": 0.89794921875
                },
                {
                    "start": 802.54,
                    "end": 802.66,
                    "word": " we",
                    "probability": 0.89794921875
                },
                {
                    "start": 802.66,
                    "end": 802.92,
                    "word": " already",
                    "probability": 0.81982421875
                },
                {
                    "start": 802.92,
                    "end": 803.52,
                    "word": " discovered",
                    "probability": 0.66455078125
                },
                {
                    "start": 803.52,
                    "end": 803.92,
                    "word": " malicious",
                    "probability": 0.802734375
                },
                {
                    "start": 803.92,
                    "end": 804.44,
                    "word": " services",
                    "probability": 0.9013671875
                },
                {
                    "start": 804.44,
                    "end": 804.92,
                    "word": " and",
                    "probability": 0.8798828125
                },
                {
                    "start": 804.92,
                    "end": 805.22,
                    "word": " scheduled",
                    "probability": 0.650390625
                },
                {
                    "start": 805.22,
                    "end": 805.74,
                    "word": " tasks",
                    "probability": 0.8759765625
                },
                {
                    "start": 805.74,
                    "end": 806.56,
                    "word": ".",
                    "probability": 0.433837890625
                }
            ]
        },
        {
            "id": 146,
            "seek": 80962,
            "start": 806.7,
            "end": 813.28,
            "text": " And later, we discovered and analyzed WMI event subscription and core profiler persistence.",
            "tokens": [
                51314,
                400,
                1780,
                11,
                321,
                6941,
                293,
                28181,
                343,
                13808,
                2280,
                17231,
                293,
                4965,
                1740,
                5441,
                37617,
                13,
                51714
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22666666388511658,
            "compression_ratio": 1.6228070175438596,
            "no_speech_prob": 0.006061553955078125,
            "words": [
                {
                    "start": 806.7,
                    "end": 806.9,
                    "word": " And",
                    "probability": 0.78271484375
                },
                {
                    "start": 806.9,
                    "end": 807.28,
                    "word": " later",
                    "probability": 0.82763671875
                },
                {
                    "start": 807.28,
                    "end": 807.42,
                    "word": ",",
                    "probability": 0.39111328125
                },
                {
                    "start": 807.42,
                    "end": 807.54,
                    "word": " we",
                    "probability": 0.892578125
                },
                {
                    "start": 807.54,
                    "end": 807.92,
                    "word": " discovered",
                    "probability": 0.599609375
                },
                {
                    "start": 807.92,
                    "end": 808.56,
                    "word": " and",
                    "probability": 0.88720703125
                },
                {
                    "start": 808.56,
                    "end": 809.06,
                    "word": " analyzed",
                    "probability": 0.63623046875
                },
                {
                    "start": 809.06,
                    "end": 809.76,
                    "word": " WMI",
                    "probability": 0.962158203125
                },
                {
                    "start": 809.76,
                    "end": 810.04,
                    "word": " event",
                    "probability": 0.60498046875
                },
                {
                    "start": 810.04,
                    "end": 810.54,
                    "word": " subscription",
                    "probability": 0.6103515625
                },
                {
                    "start": 810.54,
                    "end": 811.32,
                    "word": " and",
                    "probability": 0.85693359375
                },
                {
                    "start": 811.32,
                    "end": 811.58,
                    "word": " core",
                    "probability": 0.60986328125
                },
                {
                    "start": 811.58,
                    "end": 812.02,
                    "word": " profiler",
                    "probability": 0.919189453125
                },
                {
                    "start": 812.02,
                    "end": 812.46,
                    "word": " persistence",
                    "probability": 0.76123046875
                },
                {
                    "start": 812.46,
                    "end": 813.28,
                    "word": ".",
                    "probability": 0.99560546875
                }
            ]
        },
        {
            "id": 147,
            "seek": 83546,
            "start": 814.1,
            "end": 817.26,
            "text": " At this point, we had a lot of samples and persistence.",
            "tokens": [
                50414,
                1711,
                341,
                935,
                11,
                321,
                632,
                257,
                688,
                295,
                10938,
                293,
                37617,
                13,
                50564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.26463608500323715,
            "compression_ratio": 1.6103896103896105,
            "no_speech_prob": 0.00537872314453125,
            "words": [
                {
                    "start": 814.1,
                    "end": 814.44,
                    "word": " At",
                    "probability": 0.88134765625
                },
                {
                    "start": 814.44,
                    "end": 814.62,
                    "word": " this",
                    "probability": 0.87841796875
                },
                {
                    "start": 814.62,
                    "end": 814.98,
                    "word": " point",
                    "probability": 0.86083984375
                },
                {
                    "start": 814.98,
                    "end": 815.14,
                    "word": ",",
                    "probability": 0.73388671875
                },
                {
                    "start": 815.14,
                    "end": 815.26,
                    "word": " we",
                    "probability": 0.8994140625
                },
                {
                    "start": 815.26,
                    "end": 815.4,
                    "word": " had",
                    "probability": 0.79736328125
                },
                {
                    "start": 815.46,
                    "end": 815.58,
                    "word": " a lot",
                    "probability": 0.87158203125
                },
                {
                    "start": 815.58,
                    "end": 815.74,
                    "word": " of",
                    "probability": 0.89990234375
                },
                {
                    "start": 815.74,
                    "end": 816.06,
                    "word": " samples",
                    "probability": 0.75927734375
                },
                {
                    "start": 816.06,
                    "end": 816.26,
                    "word": " and",
                    "probability": 0.8828125
                },
                {
                    "start": 816.26,
                    "end": 816.6,
                    "word": " persistence",
                    "probability": 0.6142578125
                },
                {
                    "start": 816.6,
                    "end": 817.26,
                    "word": ".",
                    "probability": 0.4033203125
                }
            ]
        },
        {
            "id": 148,
            "seek": 83546,
            "start": 817.26,
            "end": 823.22,
            "text": " But we were faced with the questions how the attacker installed all of these persistence artifacts,",
            "tokens": [
                50564,
                583,
                321,
                645,
                11446,
                365,
                264,
                1651,
                577,
                264,
                35871,
                8899,
                439,
                295,
                613,
                37617,
                24617,
                11,
                50864
            ],
            "temperature": 0.0,
            "avg_logprob": -0.26463608500323715,
            "compression_ratio": 1.6103896103896105,
            "no_speech_prob": 0.00537872314453125,
            "words": [
                {
                    "start": 817.26,
                    "end": 817.78,
                    "word": " But",
                    "probability": 0.87841796875
                },
                {
                    "start": 817.78,
                    "end": 817.94,
                    "word": " we",
                    "probability": 0.8779296875
                },
                {
                    "start": 817.94,
                    "end": 818.1,
                    "word": " were",
                    "probability": 0.79150390625
                },
                {
                    "start": 818.1,
                    "end": 818.44,
                    "word": " faced",
                    "probability": 0.71826171875
                },
                {
                    "start": 818.44,
                    "end": 818.6,
                    "word": " with",
                    "probability": 0.60205078125
                },
                {
                    "start": 818.6,
                    "end": 818.68,
                    "word": " the",
                    "probability": 0.6533203125
                },
                {
                    "start": 818.68,
                    "end": 819.12,
                    "word": " questions",
                    "probability": 0.595703125
                },
                {
                    "start": 819.12,
                    "end": 819.74,
                    "word": " how",
                    "probability": 0.34521484375
                },
                {
                    "start": 819.74,
                    "end": 819.96,
                    "word": " the",
                    "probability": 0.55322265625
                },
                {
                    "start": 819.96,
                    "end": 820.12,
                    "word": " attacker",
                    "probability": 0.765625
                },
                {
                    "start": 820.12,
                    "end": 820.7,
                    "word": " installed",
                    "probability": 0.7548828125
                },
                {
                    "start": 820.7,
                    "end": 821.48,
                    "word": " all",
                    "probability": 0.87744140625
                },
                {
                    "start": 821.48,
                    "end": 821.64,
                    "word": " of",
                    "probability": 0.86181640625
                },
                {
                    "start": 821.64,
                    "end": 821.84,
                    "word": " these",
                    "probability": 0.67919921875
                },
                {
                    "start": 821.84,
                    "end": 822.26,
                    "word": " persistence",
                    "probability": 0.716796875
                },
                {
                    "start": 822.26,
                    "end": 822.88,
                    "word": " artifacts",
                    "probability": 0.7119140625
                },
                {
                    "start": 822.88,
                    "end": 823.22,
                    "word": ",",
                    "probability": 0.263916015625
                }
            ]
        },
        {
            "id": 149,
            "seek": 83546,
            "start": 823.22,
            "end": 831.1,
            "text": " and what they exactly did between the initial exploitation and installation of coin miners on thousands of computers.",
            "tokens": [
                50864,
                293,
                437,
                436,
                2293,
                630,
                1296,
                264,
                5883,
                33122,
                293,
                13260,
                295,
                11464,
                35640,
                322,
                5383,
                295,
                10807,
                13,
                51264
            ],
            "temperature": 0.0,
            "avg_logprob": -0.26463608500323715,
            "compression_ratio": 1.6103896103896105,
            "no_speech_prob": 0.00537872314453125,
            "words": [
                {
                    "start": 823.22,
                    "end": 823.46,
                    "word": " and",
                    "probability": 0.89306640625
                },
                {
                    "start": 823.46,
                    "end": 823.72,
                    "word": " what",
                    "probability": 0.87890625
                },
                {
                    "start": 823.72,
                    "end": 823.92,
                    "word": " they",
                    "probability": 0.67822265625
                },
                {
                    "start": 823.92,
                    "end": 824.28,
                    "word": " exactly",
                    "probability": 0.76611328125
                },
                {
                    "start": 824.28,
                    "end": 824.62,
                    "word": " did",
                    "probability": 0.89208984375
                },
                {
                    "start": 824.62,
                    "end": 825.32,
                    "word": " between",
                    "probability": 0.55712890625
                },
                {
                    "start": 825.32,
                    "end": 825.56,
                    "word": " the",
                    "probability": 0.76904296875
                },
                {
                    "start": 825.56,
                    "end": 825.8,
                    "word": " initial",
                    "probability": 0.88720703125
                },
                {
                    "start": 825.8,
                    "end": 826.44,
                    "word": " exploitation",
                    "probability": 0.84130859375
                },
                {
                    "start": 826.44,
                    "end": 827.26,
                    "word": " and",
                    "probability": 0.865234375
                },
                {
                    "start": 827.26,
                    "end": 827.84,
                    "word": " installation",
                    "probability": 0.80859375
                },
                {
                    "start": 827.84,
                    "end": 828.14,
                    "word": " of",
                    "probability": 0.90234375
                },
                {
                    "start": 828.14,
                    "end": 828.3,
                    "word": " coin",
                    "probability": 0.116943359375
                },
                {
                    "start": 828.3,
                    "end": 828.64,
                    "word": " miners",
                    "probability": 0.63134765625
                },
                {
                    "start": 828.64,
                    "end": 829.26,
                    "word": " on",
                    "probability": 0.88916015625
                },
                {
                    "start": 829.26,
                    "end": 829.7,
                    "word": " thousands",
                    "probability": 0.7861328125
                },
                {
                    "start": 829.7,
                    "end": 829.96,
                    "word": " of",
                    "probability": 0.9111328125
                },
                {
                    "start": 829.96,
                    "end": 830.42,
                    "word": " computers",
                    "probability": 0.7705078125
                },
                {
                    "start": 830.42,
                    "end": 831.1,
                    "word": ".",
                    "probability": 0.931640625
                }
            ]
        },
        {
            "id": 150,
            "seek": 83546,
            "start": 831.44,
            "end": 839.12,
            "text": " Now, we really needed to enrich our results with external data from Threat Intelligence and OSINT.",
            "tokens": [
                51264,
                823,
                11,
                321,
                534,
                2978,
                281,
                18849,
                527,
                3542,
                365,
                8320,
                1412,
                490,
                334,
                620,
                27274,
                293,
                12731,
                29398,
                13,
                51664
            ],
            "temperature": 0.0,
            "avg_logprob": -0.26463608500323715,
            "compression_ratio": 1.6103896103896105,
            "no_speech_prob": 0.00537872314453125,
            "words": [
                {
                    "start": 831.44,
                    "end": 831.96,
                    "word": " Now",
                    "probability": 0.8974609375
                },
                {
                    "start": 831.96,
                    "end": 832.26,
                    "word": ",",
                    "probability": 0.66015625
                },
                {
                    "start": 832.26,
                    "end": 832.5,
                    "word": " we",
                    "probability": 0.88623046875
                },
                {
                    "start": 832.5,
                    "end": 832.76,
                    "word": " really",
                    "probability": 0.75537109375
                },
                {
                    "start": 832.76,
                    "end": 833.22,
                    "word": " needed",
                    "probability": 0.703125
                },
                {
                    "start": 833.22,
                    "end": 833.48,
                    "word": " to",
                    "probability": 0.90283203125
                },
                {
                    "start": 833.48,
                    "end": 833.78,
                    "word": " enrich",
                    "probability": 0.35107421875
                },
                {
                    "start": 833.78,
                    "end": 834.14,
                    "word": " our",
                    "probability": 0.81396484375
                },
                {
                    "start": 834.14,
                    "end": 834.64,
                    "word": " results",
                    "probability": 0.732421875
                },
                {
                    "start": 834.64,
                    "end": 835.14,
                    "word": " with",
                    "probability": 0.79833984375
                },
                {
                    "start": 835.14,
                    "end": 835.54,
                    "word": " external",
                    "probability": 0.78564453125
                },
                {
                    "start": 835.54,
                    "end": 836.04,
                    "word": " data",
                    "probability": 0.82421875
                },
                {
                    "start": 836.04,
                    "end": 836.46,
                    "word": " from",
                    "probability": 0.80126953125
                },
                {
                    "start": 836.46,
                    "end": 836.96,
                    "word": " Threat",
                    "probability": 0.672607421875
                },
                {
                    "start": 836.96,
                    "end": 837.52,
                    "word": " Intelligence",
                    "probability": 0.82958984375
                },
                {
                    "start": 837.52,
                    "end": 837.94,
                    "word": " and",
                    "probability": 0.8818359375
                },
                {
                    "start": 837.94,
                    "end": 838.44,
                    "word": " OSINT",
                    "probability": 0.5687255859375
                },
                {
                    "start": 838.44,
                    "end": 839.12,
                    "word": ".",
                    "probability": 0.9794921875
                }
            ]
        },
        {
            "id": 151,
            "seek": 85922,
            "start": 839.12,
            "end": 843.42,
            "text": " We used a clever tool called Munin by Florian Erot.",
            "tokens": [
                50364,
                492,
                1143,
                257,
                13494,
                2290,
                1219,
                17050,
                259,
                538,
                8328,
                952,
                3300,
                310,
                13,
                50564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2379645306516338,
            "compression_ratio": 1.489795918367347,
            "no_speech_prob": 0.060455322265625,
            "words": [
                {
                    "start": 839.12,
                    "end": 839.5,
                    "word": " We",
                    "probability": 0.09814453125
                },
                {
                    "start": 839.5,
                    "end": 839.86,
                    "word": " used",
                    "probability": 0.236083984375
                },
                {
                    "start": 840.02,
                    "end": 840.26,
                    "word": " a clever",
                    "probability": 0.8876953125
                },
                {
                    "start": 840.26,
                    "end": 840.7,
                    "word": " tool",
                    "probability": 0.85791015625
                },
                {
                    "start": 840.7,
                    "end": 841.16,
                    "word": " called",
                    "probability": 0.76025390625
                },
                {
                    "start": 841.16,
                    "end": 841.56,
                    "word": " Munin",
                    "probability": 0.51708984375
                },
                {
                    "start": 841.56,
                    "end": 842.1,
                    "word": " by",
                    "probability": 0.865234375
                },
                {
                    "start": 842.1,
                    "end": 842.5,
                    "word": " Florian",
                    "probability": 0.819091796875
                },
                {
                    "start": 842.5,
                    "end": 842.78,
                    "word": " Erot",
                    "probability": 0.572021484375
                },
                {
                    "start": 842.78,
                    "end": 843.42,
                    "word": ".",
                    "probability": 0.96533203125
                }
            ]
        },
        {
            "id": 152,
            "seek": 85922,
            "start": 843.42,
            "end": 852.76,
            "text": " All we needed to do was to create one file with hashes of malware samples and let Munin do its work.",
            "tokens": [
                50564,
                1057,
                321,
                2978,
                281,
                360,
                390,
                281,
                1884,
                472,
                3991,
                365,
                575,
                8076,
                295,
                40747,
                10938,
                293,
                718,
                17050,
                259,
                360,
                1080,
                589,
                13,
                51064
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2379645306516338,
            "compression_ratio": 1.489795918367347,
            "no_speech_prob": 0.060455322265625,
            "words": [
                {
                    "start": 843.42,
                    "end": 843.68,
                    "word": " All",
                    "probability": 0.90673828125
                },
                {
                    "start": 843.68,
                    "end": 843.82,
                    "word": " we",
                    "probability": 0.904296875
                },
                {
                    "start": 843.82,
                    "end": 844.04,
                    "word": " needed",
                    "probability": 0.7275390625
                },
                {
                    "start": 844.04,
                    "end": 844.28,
                    "word": " to",
                    "probability": 0.90234375
                },
                {
                    "start": 844.28,
                    "end": 844.54,
                    "word": " do",
                    "probability": 0.90478515625
                },
                {
                    "start": 844.54,
                    "end": 844.8,
                    "word": " was",
                    "probability": 0.888671875
                },
                {
                    "start": 844.8,
                    "end": 844.98,
                    "word": " to",
                    "probability": 0.89599609375
                },
                {
                    "start": 844.98,
                    "end": 845.48,
                    "word": " create",
                    "probability": 0.82861328125
                },
                {
                    "start": 845.48,
                    "end": 846.24,
                    "word": " one",
                    "probability": 0.80908203125
                },
                {
                    "start": 846.24,
                    "end": 846.54,
                    "word": " file",
                    "probability": 0.81494140625
                },
                {
                    "start": 846.54,
                    "end": 846.88,
                    "word": " with",
                    "probability": 0.77783203125
                },
                {
                    "start": 846.88,
                    "end": 848.0,
                    "word": " hashes",
                    "probability": 0.838623046875
                },
                {
                    "start": 848.0,
                    "end": 848.34,
                    "word": " of",
                    "probability": 0.8994140625
                },
                {
                    "start": 848.34,
                    "end": 848.64,
                    "word": " malware",
                    "probability": 0.77197265625
                },
                {
                    "start": 848.64,
                    "end": 849.16,
                    "word": " samples",
                    "probability": 0.77587890625
                },
                {
                    "start": 849.16,
                    "end": 849.8,
                    "word": " and",
                    "probability": 0.75830078125
                },
                {
                    "start": 849.8,
                    "end": 850.0,
                    "word": " let",
                    "probability": 0.8642578125
                },
                {
                    "start": 850.0,
                    "end": 850.38,
                    "word": " Munin",
                    "probability": 0.947265625
                },
                {
                    "start": 850.38,
                    "end": 850.78,
                    "word": " do",
                    "probability": 0.26318359375
                },
                {
                    "start": 850.78,
                    "end": 851.7,
                    "word": " its",
                    "probability": 0.75634765625
                },
                {
                    "start": 851.7,
                    "end": 852.04,
                    "word": " work",
                    "probability": 0.794921875
                },
                {
                    "start": 852.04,
                    "end": 852.76,
                    "word": ".",
                    "probability": 0.99267578125
                }
            ]
        },
        {
            "id": 153,
            "seek": 85922,
            "start": 853.04,
            "end": 862.88,
            "text": " We found several hashes in public repositories, but there were only one public submission of the DLL installer, without any trace detected.",
            "tokens": [
                51064,
                492,
                1352,
                2940,
                575,
                8076,
                294,
                1908,
                22283,
                2083,
                11,
                457,
                456,
                645,
                787,
                472,
                1908,
                23689,
                295,
                264,
                413,
                24010,
                46620,
                11,
                1553,
                604,
                13508,
                21896,
                13,
                51564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2379645306516338,
            "compression_ratio": 1.489795918367347,
            "no_speech_prob": 0.060455322265625,
            "words": [
                {
                    "start": 853.04,
                    "end": 853.22,
                    "word": " We",
                    "probability": 0.90478515625
                },
                {
                    "start": 853.22,
                    "end": 853.62,
                    "word": " found",
                    "probability": 0.525390625
                },
                {
                    "start": 853.62,
                    "end": 854.1,
                    "word": " several",
                    "probability": 0.828125
                },
                {
                    "start": 854.1,
                    "end": 854.4,
                    "word": " hashes",
                    "probability": 0.90771484375
                },
                {
                    "start": 854.4,
                    "end": 854.62,
                    "word": " in",
                    "probability": 0.90380859375
                },
                {
                    "start": 854.62,
                    "end": 854.86,
                    "word": " public",
                    "probability": 0.85205078125
                },
                {
                    "start": 854.86,
                    "end": 855.54,
                    "word": " repositories",
                    "probability": 0.896728515625
                },
                {
                    "start": 855.54,
                    "end": 856.04,
                    "word": ",",
                    "probability": 0.70849609375
                },
                {
                    "start": 856.04,
                    "end": 856.16,
                    "word": " but",
                    "probability": 0.8984375
                },
                {
                    "start": 856.16,
                    "end": 856.56,
                    "word": " there",
                    "probability": 0.84912109375
                },
                {
                    "start": 856.56,
                    "end": 856.8,
                    "word": " were",
                    "probability": 0.806640625
                },
                {
                    "start": 856.8,
                    "end": 857.1,
                    "word": " only",
                    "probability": 0.84619140625
                },
                {
                    "start": 857.1,
                    "end": 857.42,
                    "word": " one",
                    "probability": 0.80615234375
                },
                {
                    "start": 857.42,
                    "end": 857.72,
                    "word": " public",
                    "probability": 0.79052734375
                },
                {
                    "start": 857.72,
                    "end": 858.2,
                    "word": " submission",
                    "probability": 0.77001953125
                },
                {
                    "start": 858.2,
                    "end": 859.2,
                    "word": " of",
                    "probability": 0.89794921875
                },
                {
                    "start": 859.2,
                    "end": 859.4,
                    "word": " the",
                    "probability": 0.8173828125
                },
                {
                    "start": 859.4,
                    "end": 859.72,
                    "word": " DLL",
                    "probability": 0.896728515625
                },
                {
                    "start": 859.72,
                    "end": 860.3,
                    "word": " installer",
                    "probability": 0.67041015625
                },
                {
                    "start": 860.3,
                    "end": 860.76,
                    "word": ",",
                    "probability": 0.203125
                },
                {
                    "start": 860.76,
                    "end": 861.16,
                    "word": " without",
                    "probability": 0.81494140625
                },
                {
                    "start": 861.16,
                    "end": 861.52,
                    "word": " any",
                    "probability": 0.77685546875
                },
                {
                    "start": 861.52,
                    "end": 861.74,
                    "word": " trace",
                    "probability": 0.411865234375
                },
                {
                    "start": 861.74,
                    "end": 862.16,
                    "word": " detected",
                    "probability": 0.83056640625
                },
                {
                    "start": 862.16,
                    "end": 862.88,
                    "word": ".",
                    "probability": 0.99755859375
                }
            ]
        },
        {
            "id": 154,
            "seek": 88696,
            "start": 862.88,
            "end": 871.22,
            "text": " When we did a context search instead of object search, we get another submission, as we can see in the picture.",
            "tokens": [
                50364,
                1133,
                321,
                630,
                257,
                4319,
                3164,
                2602,
                295,
                2657,
                3164,
                11,
                321,
                483,
                1071,
                23689,
                11,
                382,
                321,
                393,
                536,
                294,
                264,
                3036,
                13,
                50764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24062499420510397,
            "compression_ratio": 1.48,
            "no_speech_prob": 0.01739501953125,
            "words": [
                {
                    "start": 862.88,
                    "end": 863.5,
                    "word": " When",
                    "probability": 0.6826171875
                },
                {
                    "start": 863.5,
                    "end": 863.7,
                    "word": " we",
                    "probability": 0.89453125
                },
                {
                    "start": 863.7,
                    "end": 863.94,
                    "word": " did",
                    "probability": 0.8916015625
                },
                {
                    "start": 864.1,
                    "end": 864.38,
                    "word": " a context",
                    "probability": 0.7080078125
                },
                {
                    "start": 864.38,
                    "end": 864.84,
                    "word": " search",
                    "probability": 0.85595703125
                },
                {
                    "start": 864.84,
                    "end": 865.32,
                    "word": " instead",
                    "probability": 0.77001953125
                },
                {
                    "start": 865.32,
                    "end": 865.9,
                    "word": " of",
                    "probability": 0.9052734375
                },
                {
                    "start": 865.9,
                    "end": 866.24,
                    "word": " object",
                    "probability": 0.86865234375
                },
                {
                    "start": 866.24,
                    "end": 866.66,
                    "word": " search",
                    "probability": 0.9140625
                },
                {
                    "start": 866.66,
                    "end": 867.1,
                    "word": ",",
                    "probability": 0.90380859375
                },
                {
                    "start": 867.1,
                    "end": 867.28,
                    "word": " we",
                    "probability": 0.89501953125
                },
                {
                    "start": 867.28,
                    "end": 867.48,
                    "word": " get",
                    "probability": 0.892578125
                },
                {
                    "start": 867.48,
                    "end": 867.78,
                    "word": " another",
                    "probability": 0.833984375
                },
                {
                    "start": 867.78,
                    "end": 868.24,
                    "word": " submission",
                    "probability": 0.806640625
                },
                {
                    "start": 868.24,
                    "end": 868.76,
                    "word": ",",
                    "probability": 0.402587890625
                },
                {
                    "start": 868.76,
                    "end": 869.06,
                    "word": " as",
                    "probability": 0.9013671875
                },
                {
                    "start": 869.06,
                    "end": 869.3,
                    "word": " we",
                    "probability": 0.904296875
                },
                {
                    "start": 869.3,
                    "end": 869.58,
                    "word": " can",
                    "probability": 0.8974609375
                },
                {
                    "start": 869.58,
                    "end": 869.84,
                    "word": " see",
                    "probability": 0.81298828125
                },
                {
                    "start": 869.84,
                    "end": 870.06,
                    "word": " in",
                    "probability": 0.90673828125
                },
                {
                    "start": 870.06,
                    "end": 870.18,
                    "word": " the",
                    "probability": 0.8125
                },
                {
                    "start": 870.18,
                    "end": 870.54,
                    "word": " picture",
                    "probability": 0.77587890625
                },
                {
                    "start": 870.54,
                    "end": 871.22,
                    "word": ".",
                    "probability": 0.67919921875
                }
            ]
        },
        {
            "id": 155,
            "seek": 88696,
            "start": 871.44,
            "end": 874.68,
            "text": " The zip archive with potentially malicious files.",
            "tokens": [
                50764,
                440,
                20730,
                23507,
                365,
                7263,
                33496,
                7098,
                13,
                50964
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24062499420510397,
            "compression_ratio": 1.48,
            "no_speech_prob": 0.01739501953125,
            "words": [
                {
                    "start": 871.44,
                    "end": 871.54,
                    "word": " The",
                    "probability": 0.77587890625
                },
                {
                    "start": 871.54,
                    "end": 871.72,
                    "word": " zip",
                    "probability": 0.74365234375
                },
                {
                    "start": 871.72,
                    "end": 872.24,
                    "word": " archive",
                    "probability": 0.71484375
                },
                {
                    "start": 872.24,
                    "end": 872.68,
                    "word": " with",
                    "probability": 0.802734375
                },
                {
                    "start": 872.68,
                    "end": 873.14,
                    "word": " potentially",
                    "probability": 0.638671875
                },
                {
                    "start": 873.14,
                    "end": 873.48,
                    "word": " malicious",
                    "probability": 0.7666015625
                },
                {
                    "start": 873.48,
                    "end": 874.0,
                    "word": " files",
                    "probability": 0.74658203125
                },
                {
                    "start": 874.0,
                    "end": 874.68,
                    "word": ".",
                    "probability": 0.9970703125
                }
            ]
        },
        {
            "id": 156,
            "seek": 88696,
            "start": 876.9,
            "end": 880.14,
            "text": " Now, let's look on the zipkernel file.",
            "tokens": [
                51064,
                823,
                11,
                718,
                311,
                574,
                322,
                264,
                20730,
                74,
                1248,
                338,
                3991,
                13,
                51214
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24062499420510397,
            "compression_ratio": 1.48,
            "no_speech_prob": 0.01739501953125,
            "words": [
                {
                    "start": 876.9,
                    "end": 877.58,
                    "word": " Now",
                    "probability": 0.8857421875
                },
                {
                    "start": 877.58,
                    "end": 877.72,
                    "word": ",",
                    "probability": 0.6240234375
                },
                {
                    "start": 877.72,
                    "end": 877.9,
                    "word": " let's",
                    "probability": 0.943359375
                },
                {
                    "start": 877.9,
                    "end": 878.2,
                    "word": " look",
                    "probability": 0.9072265625
                },
                {
                    "start": 878.2,
                    "end": 878.56,
                    "word": " on",
                    "probability": 0.865234375
                },
                {
                    "start": 878.56,
                    "end": 878.68,
                    "word": " the",
                    "probability": 0.81494140625
                },
                {
                    "start": 878.68,
                    "end": 879.14,
                    "word": " zipkernel",
                    "probability": 0.6226959228515625
                },
                {
                    "start": 879.14,
                    "end": 879.46,
                    "word": " file",
                    "probability": 0.82275390625
                },
                {
                    "start": 879.46,
                    "end": 880.14,
                    "word": ".",
                    "probability": 0.982421875
                }
            ]
        },
        {
            "id": 157,
            "seek": 88696,
            "start": 880.28,
            "end": 887.7,
            "text": " It contains several DLLs, batch files, and one MOF file, which stands for Managed Object Format.",
            "tokens": [
                51214,
                467,
                8306,
                2940,
                413,
                24010,
                82,
                11,
                15245,
                7098,
                11,
                293,
                472,
                19290,
                37,
                3991,
                11,
                597,
                7382,
                337,
                2458,
                2980,
                24753,
                10126,
                267,
                13,
                51614
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24062499420510397,
            "compression_ratio": 1.48,
            "no_speech_prob": 0.01739501953125,
            "words": [
                {
                    "start": 880.28,
                    "end": 880.48,
                    "word": " It",
                    "probability": 0.90380859375
                },
                {
                    "start": 880.48,
                    "end": 880.92,
                    "word": " contains",
                    "probability": 0.7734375
                },
                {
                    "start": 880.92,
                    "end": 881.26,
                    "word": " several",
                    "probability": 0.84716796875
                },
                {
                    "start": 881.26,
                    "end": 881.98,
                    "word": " DLLs",
                    "probability": 0.9034830729166666
                },
                {
                    "start": 881.98,
                    "end": 882.32,
                    "word": ",",
                    "probability": 0.935546875
                },
                {
                    "start": 882.32,
                    "end": 882.5,
                    "word": " batch",
                    "probability": 0.7841796875
                },
                {
                    "start": 882.5,
                    "end": 882.86,
                    "word": " files",
                    "probability": 0.8046875
                },
                {
                    "start": 882.86,
                    "end": 883.04,
                    "word": ",",
                    "probability": 0.60302734375
                },
                {
                    "start": 883.04,
                    "end": 883.1,
                    "word": " and",
                    "probability": 0.9013671875
                },
                {
                    "start": 883.1,
                    "end": 883.4,
                    "word": " one",
                    "probability": 0.78173828125
                },
                {
                    "start": 883.4,
                    "end": 883.84,
                    "word": " MOF",
                    "probability": 0.641357421875
                },
                {
                    "start": 883.84,
                    "end": 884.2,
                    "word": " file",
                    "probability": 0.85107421875
                },
                {
                    "start": 884.2,
                    "end": 884.38,
                    "word": ",",
                    "probability": 0.513671875
                },
                {
                    "start": 884.38,
                    "end": 884.46,
                    "word": " which",
                    "probability": 0.89404296875
                },
                {
                    "start": 884.46,
                    "end": 884.78,
                    "word": " stands",
                    "probability": 0.67822265625
                },
                {
                    "start": 884.78,
                    "end": 885.38,
                    "word": " for",
                    "probability": 0.8876953125
                },
                {
                    "start": 885.38,
                    "end": 886.08,
                    "word": " Managed",
                    "probability": 0.75830078125
                },
                {
                    "start": 886.08,
                    "end": 886.52,
                    "word": " Object",
                    "probability": 0.83154296875
                },
                {
                    "start": 886.52,
                    "end": 887.02,
                    "word": " Format",
                    "probability": 0.89208984375
                },
                {
                    "start": 887.02,
                    "end": 887.7,
                    "word": ".",
                    "probability": 0.99609375
                }
            ]
        },
        {
            "id": 158,
            "seek": 88696,
            "start": 887.98,
            "end": 890.62,
            "text": " We were familiar with some of them.",
            "tokens": [
                51614,
                492,
                645,
                4963,
                365,
                512,
                295,
                552,
                13,
                51764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24062499420510397,
            "compression_ratio": 1.48,
            "no_speech_prob": 0.01739501953125,
            "words": [
                {
                    "start": 887.98,
                    "end": 888.28,
                    "word": " We",
                    "probability": 0.87060546875
                },
                {
                    "start": 888.28,
                    "end": 888.54,
                    "word": " were",
                    "probability": 0.7275390625
                },
                {
                    "start": 888.54,
                    "end": 888.92,
                    "word": " familiar",
                    "probability": 0.80029296875
                },
                {
                    "start": 888.92,
                    "end": 889.28,
                    "word": " with",
                    "probability": 0.80908203125
                },
                {
                    "start": 889.28,
                    "end": 889.54,
                    "word": " some",
                    "probability": 0.82763671875
                },
                {
                    "start": 889.54,
                    "end": 889.68,
                    "word": " of",
                    "probability": 0.90625
                },
                {
                    "start": 889.68,
                    "end": 889.94,
                    "word": " them",
                    "probability": 0.736328125
                },
                {
                    "start": 889.94,
                    "end": 890.62,
                    "word": ".",
                    "probability": 0.98583984375
                }
            ]
        },
        {
            "id": 159,
            "seek": 91202,
            "start": 891.78,
            "end": 896.88,
            "text": " One DLL was coin miner and the second was installer we already analyzed.",
            "tokens": [
                50414,
                1485,
                413,
                24010,
                390,
                11464,
                18746,
                293,
                264,
                1150,
                390,
                46620,
                321,
                1217,
                28181,
                13,
                50664
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21322917143503825,
            "compression_ratio": 1.4712041884816753,
            "no_speech_prob": 0.00641632080078125,
            "words": [
                {
                    "start": 891.78,
                    "end": 892.54,
                    "word": " One",
                    "probability": 0.7841796875
                },
                {
                    "start": 892.54,
                    "end": 892.88,
                    "word": " DLL",
                    "probability": 0.857177734375
                },
                {
                    "start": 892.88,
                    "end": 893.14,
                    "word": " was",
                    "probability": 0.88037109375
                },
                {
                    "start": 893.14,
                    "end": 893.34,
                    "word": " coin",
                    "probability": 0.3720703125
                },
                {
                    "start": 893.34,
                    "end": 893.64,
                    "word": " miner",
                    "probability": 0.2408447265625
                },
                {
                    "start": 893.64,
                    "end": 894.2,
                    "word": " and",
                    "probability": 0.62548828125
                },
                {
                    "start": 894.2,
                    "end": 894.32,
                    "word": " the",
                    "probability": 0.79248046875
                },
                {
                    "start": 894.32,
                    "end": 894.56,
                    "word": " second",
                    "probability": 0.79541015625
                },
                {
                    "start": 894.56,
                    "end": 894.84,
                    "word": " was",
                    "probability": 0.85791015625
                },
                {
                    "start": 894.84,
                    "end": 895.26,
                    "word": " installer",
                    "probability": 0.51416015625
                },
                {
                    "start": 895.26,
                    "end": 895.64,
                    "word": " we",
                    "probability": 0.6787109375
                },
                {
                    "start": 895.64,
                    "end": 895.96,
                    "word": " already",
                    "probability": 0.85595703125
                },
                {
                    "start": 895.96,
                    "end": 896.5,
                    "word": " analyzed",
                    "probability": 0.599609375
                },
                {
                    "start": 896.5,
                    "end": 896.88,
                    "word": ".",
                    "probability": 0.92626953125
                }
            ]
        },
        {
            "id": 160,
            "seek": 91202,
            "start": 897.36,
            "end": 899.86,
            "text": " The MOF file was interesting.",
            "tokens": [
                50664,
                440,
                19290,
                37,
                3991,
                390,
                1880,
                13,
                50814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21322917143503825,
            "compression_ratio": 1.4712041884816753,
            "no_speech_prob": 0.00641632080078125,
            "words": [
                {
                    "start": 897.36,
                    "end": 897.48,
                    "word": " The",
                    "probability": 0.71337890625
                },
                {
                    "start": 897.48,
                    "end": 897.76,
                    "word": " MOF",
                    "probability": 0.1774768829345703
                },
                {
                    "start": 897.76,
                    "end": 898.18,
                    "word": " file",
                    "probability": 0.61279296875
                },
                {
                    "start": 898.18,
                    "end": 898.58,
                    "word": " was",
                    "probability": 0.8984375
                },
                {
                    "start": 898.58,
                    "end": 899.1,
                    "word": " interesting",
                    "probability": 0.6416015625
                },
                {
                    "start": 899.1,
                    "end": 899.86,
                    "word": ".",
                    "probability": 0.93701171875
                }
            ]
        },
        {
            "id": 161,
            "seek": 91202,
            "start": 899.86,
            "end": 902.98,
            "text": " Now, you can see its content on the right.",
            "tokens": [
                50814,
                823,
                11,
                291,
                393,
                536,
                1080,
                2701,
                322,
                264,
                558,
                13,
                50964
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21322917143503825,
            "compression_ratio": 1.4712041884816753,
            "no_speech_prob": 0.00641632080078125,
            "words": [
                {
                    "start": 899.86,
                    "end": 900.22,
                    "word": " Now",
                    "probability": 0.87744140625
                },
                {
                    "start": 900.22,
                    "end": 900.88,
                    "word": ",",
                    "probability": 0.5068359375
                },
                {
                    "start": 900.88,
                    "end": 900.98,
                    "word": " you",
                    "probability": 0.7109375
                },
                {
                    "start": 900.98,
                    "end": 901.12,
                    "word": " can",
                    "probability": 0.890625
                },
                {
                    "start": 901.12,
                    "end": 901.4,
                    "word": " see",
                    "probability": 0.8056640625
                },
                {
                    "start": 901.4,
                    "end": 901.6,
                    "word": " its",
                    "probability": 0.7236328125
                },
                {
                    "start": 901.6,
                    "end": 902.0,
                    "word": " content",
                    "probability": 0.826171875
                },
                {
                    "start": 902.0,
                    "end": 902.22,
                    "word": " on",
                    "probability": 0.9052734375
                },
                {
                    "start": 902.22,
                    "end": 902.32,
                    "word": " the",
                    "probability": 0.81298828125
                },
                {
                    "start": 902.32,
                    "end": 902.6,
                    "word": " right",
                    "probability": 0.87646484375
                },
                {
                    "start": 902.6,
                    "end": 902.98,
                    "word": ".",
                    "probability": 0.95947265625
                }
            ]
        },
        {
            "id": 162,
            "seek": 91202,
            "start": 903.42,
            "end": 910.82,
            "text": " It contained definitions of WMI event subscriptions used for persistence we found earlier.",
            "tokens": [
                50964,
                467,
                16212,
                21988,
                295,
                343,
                13808,
                2280,
                44951,
                1143,
                337,
                37617,
                321,
                1352,
                3071,
                13,
                51364
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21322917143503825,
            "compression_ratio": 1.4712041884816753,
            "no_speech_prob": 0.00641632080078125,
            "words": [
                {
                    "start": 903.42,
                    "end": 903.6,
                    "word": " It",
                    "probability": 0.8935546875
                },
                {
                    "start": 903.6,
                    "end": 904.18,
                    "word": " contained",
                    "probability": 0.77392578125
                },
                {
                    "start": 904.18,
                    "end": 904.88,
                    "word": " definitions",
                    "probability": 0.74169921875
                },
                {
                    "start": 904.88,
                    "end": 905.82,
                    "word": " of",
                    "probability": 0.896484375
                },
                {
                    "start": 905.82,
                    "end": 906.64,
                    "word": " WMI",
                    "probability": 0.9443359375
                },
                {
                    "start": 906.64,
                    "end": 907.0,
                    "word": " event",
                    "probability": 0.43310546875
                },
                {
                    "start": 907.0,
                    "end": 907.56,
                    "word": " subscriptions",
                    "probability": 0.61962890625
                },
                {
                    "start": 907.56,
                    "end": 908.32,
                    "word": " used",
                    "probability": 0.7607421875
                },
                {
                    "start": 908.32,
                    "end": 908.58,
                    "word": " for",
                    "probability": 0.89404296875
                },
                {
                    "start": 908.58,
                    "end": 909.04,
                    "word": " persistence",
                    "probability": 0.81982421875
                },
                {
                    "start": 909.04,
                    "end": 909.36,
                    "word": " we",
                    "probability": 0.83349609375
                },
                {
                    "start": 909.36,
                    "end": 909.84,
                    "word": " found",
                    "probability": 0.822265625
                },
                {
                    "start": 909.84,
                    "end": 910.22,
                    "word": " earlier",
                    "probability": 0.90234375
                },
                {
                    "start": 910.22,
                    "end": 910.82,
                    "word": ".",
                    "probability": 0.95263671875
                }
            ]
        },
        {
            "id": 163,
            "seek": 91202,
            "start": 910.82,
            "end": 912.72,
            "text": " So, we got it.",
            "tokens": [
                51364,
                407,
                11,
                321,
                658,
                309,
                13,
                51464
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21322917143503825,
            "compression_ratio": 1.4712041884816753,
            "no_speech_prob": 0.00641632080078125,
            "words": [
                {
                    "start": 910.82,
                    "end": 911.22,
                    "word": " So",
                    "probability": 0.86279296875
                },
                {
                    "start": 911.22,
                    "end": 911.52,
                    "word": ",",
                    "probability": 0.58251953125
                },
                {
                    "start": 911.52,
                    "end": 911.64,
                    "word": " we",
                    "probability": 0.8994140625
                },
                {
                    "start": 911.64,
                    "end": 911.84,
                    "word": " got",
                    "probability": 0.8681640625
                },
                {
                    "start": 911.84,
                    "end": 912.08,
                    "word": " it",
                    "probability": 0.8720703125
                },
                {
                    "start": 912.08,
                    "end": 912.72,
                    "word": ".",
                    "probability": 0.7392578125
                }
            ]
        },
        {
            "id": 164,
            "seek": 91202,
            "start": 912.72,
            "end": 915.68,
            "text": " We found the WMI persistence.",
            "tokens": [
                51464,
                492,
                1352,
                264,
                343,
                13808,
                37617,
                13,
                51614
            ],
            "temperature": 0.0,
            "avg_logprob": -0.21322917143503825,
            "compression_ratio": 1.4712041884816753,
            "no_speech_prob": 0.00641632080078125,
            "words": [
                {
                    "start": 912.72,
                    "end": 912.96,
                    "word": " We",
                    "probability": 0.9033203125
                },
                {
                    "start": 912.96,
                    "end": 913.3,
                    "word": " found",
                    "probability": 0.88330078125
                },
                {
                    "start": 913.3,
                    "end": 913.78,
                    "word": " the",
                    "probability": 0.78662109375
                },
                {
                    "start": 913.78,
                    "end": 914.36,
                    "word": " WMI",
                    "probability": 0.97705078125
                },
                {
                    "start": 914.36,
                    "end": 914.92,
                    "word": " persistence",
                    "probability": 0.78125
                },
                {
                    "start": 914.92,
                    "end": 915.68,
                    "word": ".",
                    "probability": 0.98779296875
                }
            ]
        },
        {
            "id": 165,
            "seek": 94050,
            "start": 915.68,
            "end": 920.7,
            "text": " Now, we are aware how it was created.",
            "tokens": [
                50364,
                823,
                11,
                321,
                366,
                3650,
                577,
                309,
                390,
                2942,
                13,
                50564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24913195504082575,
            "compression_ratio": 1.563063063063063,
            "no_speech_prob": 0.00856781005859375,
            "words": [
                {
                    "start": 915.68,
                    "end": 916.82,
                    "word": " Now",
                    "probability": 0.467041015625
                },
                {
                    "start": 916.82,
                    "end": 917.0,
                    "word": ",",
                    "probability": 0.1505126953125
                },
                {
                    "start": 917.0,
                    "end": 917.1,
                    "word": " we",
                    "probability": 0.9013671875
                },
                {
                    "start": 917.1,
                    "end": 917.3,
                    "word": " are",
                    "probability": 0.849609375
                },
                {
                    "start": 917.3,
                    "end": 917.78,
                    "word": " aware",
                    "probability": 0.79736328125
                },
                {
                    "start": 917.78,
                    "end": 918.56,
                    "word": " how",
                    "probability": 0.7099609375
                },
                {
                    "start": 918.56,
                    "end": 918.96,
                    "word": " it",
                    "probability": 0.90185546875
                },
                {
                    "start": 918.96,
                    "end": 919.32,
                    "word": " was",
                    "probability": 0.89208984375
                },
                {
                    "start": 919.32,
                    "end": 920.04,
                    "word": " created",
                    "probability": 0.71533203125
                },
                {
                    "start": 920.04,
                    "end": 920.7,
                    "word": ".",
                    "probability": 0.96484375
                }
            ]
        },
        {
            "id": 166,
            "seek": 94050,
            "start": 922.06,
            "end": 924.42,
            "text": " But what about the batch files?",
            "tokens": [
                50664,
                583,
                437,
                466,
                264,
                15245,
                7098,
                30,
                50764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24913195504082575,
            "compression_ratio": 1.563063063063063,
            "no_speech_prob": 0.00856781005859375,
            "words": [
                {
                    "start": 922.06,
                    "end": 922.62,
                    "word": " But",
                    "probability": 0.72607421875
                },
                {
                    "start": 922.62,
                    "end": 922.84,
                    "word": " what",
                    "probability": 0.798828125
                },
                {
                    "start": 922.84,
                    "end": 923.16,
                    "word": " about",
                    "probability": 0.83203125
                },
                {
                    "start": 923.16,
                    "end": 923.4,
                    "word": " the",
                    "probability": 0.79296875
                },
                {
                    "start": 923.4,
                    "end": 923.56,
                    "word": " batch",
                    "probability": 0.80615234375
                },
                {
                    "start": 923.56,
                    "end": 923.92,
                    "word": " files",
                    "probability": 0.74609375
                },
                {
                    "start": 923.92,
                    "end": 924.42,
                    "word": "?",
                    "probability": 0.87353515625
                }
            ]
        },
        {
            "id": 167,
            "seek": 94050,
            "start": 924.42,
            "end": 931.42,
            "text": " They were new for us, but there was a strong assumption that they were also related to the same ethics.",
            "tokens": [
                50764,
                814,
                645,
                777,
                337,
                505,
                11,
                457,
                456,
                390,
                257,
                2068,
                15302,
                300,
                436,
                645,
                611,
                4077,
                281,
                264,
                912,
                19769,
                13,
                51114
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24913195504082575,
            "compression_ratio": 1.563063063063063,
            "no_speech_prob": 0.00856781005859375,
            "words": [
                {
                    "start": 924.42,
                    "end": 924.66,
                    "word": " They",
                    "probability": 0.5849609375
                },
                {
                    "start": 924.66,
                    "end": 924.98,
                    "word": " were",
                    "probability": 0.6748046875
                },
                {
                    "start": 924.98,
                    "end": 925.42,
                    "word": " new",
                    "probability": 0.751953125
                },
                {
                    "start": 925.42,
                    "end": 925.66,
                    "word": " for",
                    "probability": 0.8876953125
                },
                {
                    "start": 925.66,
                    "end": 925.96,
                    "word": " us",
                    "probability": 0.90625
                },
                {
                    "start": 925.96,
                    "end": 926.52,
                    "word": ",",
                    "probability": 0.57177734375
                },
                {
                    "start": 926.52,
                    "end": 926.74,
                    "word": " but",
                    "probability": 0.8896484375
                },
                {
                    "start": 926.74,
                    "end": 926.98,
                    "word": " there",
                    "probability": 0.8291015625
                },
                {
                    "start": 926.98,
                    "end": 927.2,
                    "word": " was",
                    "probability": 0.85107421875
                },
                {
                    "start": 927.28,
                    "end": 927.54,
                    "word": " a strong",
                    "probability": 0.84375
                },
                {
                    "start": 927.54,
                    "end": 928.0,
                    "word": " assumption",
                    "probability": 0.86376953125
                },
                {
                    "start": 928.0,
                    "end": 928.7,
                    "word": " that",
                    "probability": 0.82958984375
                },
                {
                    "start": 928.7,
                    "end": 928.88,
                    "word": " they",
                    "probability": 0.73095703125
                },
                {
                    "start": 928.88,
                    "end": 929.1,
                    "word": " were",
                    "probability": 0.833984375
                },
                {
                    "start": 929.1,
                    "end": 929.42,
                    "word": " also",
                    "probability": 0.8203125
                },
                {
                    "start": 929.42,
                    "end": 929.82,
                    "word": " related",
                    "probability": 0.869140625
                },
                {
                    "start": 929.82,
                    "end": 930.06,
                    "word": " to",
                    "probability": 0.900390625
                },
                {
                    "start": 930.06,
                    "end": 930.22,
                    "word": " the",
                    "probability": 0.7392578125
                },
                {
                    "start": 930.22,
                    "end": 930.42,
                    "word": " same",
                    "probability": 0.472412109375
                },
                {
                    "start": 930.42,
                    "end": 930.76,
                    "word": " ethics",
                    "probability": 0.32373046875
                },
                {
                    "start": 930.76,
                    "end": 931.42,
                    "word": ".",
                    "probability": 0.98291015625
                }
            ]
        },
        {
            "id": 168,
            "seek": 94050,
            "start": 931.48,
            "end": 935.7,
            "text": " When we examined the RNBAT file, we could say,",
            "tokens": [
                51114,
                1133,
                321,
                30972,
                264,
                45702,
                33,
                2218,
                3991,
                11,
                321,
                727,
                584,
                11,
                51314
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24913195504082575,
            "compression_ratio": 1.563063063063063,
            "no_speech_prob": 0.00856781005859375,
            "words": [
                {
                    "start": 931.48,
                    "end": 931.62,
                    "word": " When",
                    "probability": 0.77880859375
                },
                {
                    "start": 931.62,
                    "end": 931.76,
                    "word": " we",
                    "probability": 0.89453125
                },
                {
                    "start": 931.76,
                    "end": 932.26,
                    "word": " examined",
                    "probability": 0.83642578125
                },
                {
                    "start": 932.26,
                    "end": 932.76,
                    "word": " the",
                    "probability": 0.80859375
                },
                {
                    "start": 932.76,
                    "end": 933.9,
                    "word": " RNBAT",
                    "probability": 0.560546875
                },
                {
                    "start": 933.9,
                    "end": 934.26,
                    "word": " file",
                    "probability": 0.83642578125
                },
                {
                    "start": 934.26,
                    "end": 934.68,
                    "word": ",",
                    "probability": 0.92041015625
                },
                {
                    "start": 934.68,
                    "end": 934.78,
                    "word": " we",
                    "probability": 0.66259765625
                },
                {
                    "start": 934.78,
                    "end": 934.94,
                    "word": " could",
                    "probability": 0.82080078125
                },
                {
                    "start": 934.94,
                    "end": 935.28,
                    "word": " say",
                    "probability": 0.87158203125
                },
                {
                    "start": 935.28,
                    "end": 935.7,
                    "word": ",",
                    "probability": 0.53662109375
                }
            ]
        },
        {
            "id": 169,
            "seek": 94050,
            "start": 935.7,
            "end": 936.9,
            "text": " Eureka!",
            "tokens": [
                51314,
                462,
                540,
                2330,
                0,
                51414
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24913195504082575,
            "compression_ratio": 1.563063063063063,
            "no_speech_prob": 0.00856781005859375,
            "words": [
                {
                    "start": 935.7,
                    "end": 936.24,
                    "word": " Eureka",
                    "probability": 0.628021240234375
                },
                {
                    "start": 936.24,
                    "end": 936.9,
                    "word": "!",
                    "probability": 0.68408203125
                }
            ]
        },
        {
            "id": 170,
            "seek": 94050,
            "start": 936.9,
            "end": 944.16,
            "text": " This batch file was an installation script for all stuff related to coin miners and persistence we already discovered.",
            "tokens": [
                51414,
                639,
                15245,
                3991,
                390,
                364,
                13260,
                5755,
                337,
                439,
                1507,
                4077,
                281,
                11464,
                35640,
                293,
                37617,
                321,
                1217,
                6941,
                13,
                51764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24913195504082575,
            "compression_ratio": 1.563063063063063,
            "no_speech_prob": 0.00856781005859375,
            "words": [
                {
                    "start": 936.9,
                    "end": 937.38,
                    "word": " This",
                    "probability": 0.76611328125
                },
                {
                    "start": 937.38,
                    "end": 937.68,
                    "word": " batch",
                    "probability": 0.78759765625
                },
                {
                    "start": 937.68,
                    "end": 938.04,
                    "word": " file",
                    "probability": 0.79150390625
                },
                {
                    "start": 938.04,
                    "end": 938.36,
                    "word": " was",
                    "probability": 0.88818359375
                },
                {
                    "start": 938.36,
                    "end": 938.54,
                    "word": " an",
                    "probability": 0.89111328125
                },
                {
                    "start": 938.54,
                    "end": 939.0,
                    "word": " installation",
                    "probability": 0.8828125
                },
                {
                    "start": 939.0,
                    "end": 939.42,
                    "word": " script",
                    "probability": 0.77099609375
                },
                {
                    "start": 939.42,
                    "end": 939.66,
                    "word": " for",
                    "probability": 0.89697265625
                },
                {
                    "start": 939.66,
                    "end": 939.96,
                    "word": " all",
                    "probability": 0.8740234375
                },
                {
                    "start": 939.96,
                    "end": 940.2,
                    "word": " stuff",
                    "probability": 0.68798828125
                },
                {
                    "start": 940.2,
                    "end": 940.58,
                    "word": " related",
                    "probability": 0.85107421875
                },
                {
                    "start": 940.58,
                    "end": 940.9,
                    "word": " to",
                    "probability": 0.900390625
                },
                {
                    "start": 940.9,
                    "end": 941.16,
                    "word": " coin",
                    "probability": 0.66455078125
                },
                {
                    "start": 941.16,
                    "end": 941.6,
                    "word": " miners",
                    "probability": 0.90234375
                },
                {
                    "start": 941.6,
                    "end": 942.08,
                    "word": " and",
                    "probability": 0.861328125
                },
                {
                    "start": 942.08,
                    "end": 942.52,
                    "word": " persistence",
                    "probability": 0.681640625
                },
                {
                    "start": 942.52,
                    "end": 942.74,
                    "word": " we",
                    "probability": 0.8466796875
                },
                {
                    "start": 942.74,
                    "end": 943.02,
                    "word": " already",
                    "probability": 0.74169921875
                },
                {
                    "start": 943.02,
                    "end": 943.5,
                    "word": " discovered",
                    "probability": 0.650390625
                },
                {
                    "start": 943.5,
                    "end": 944.16,
                    "word": ".",
                    "probability": 0.9619140625
                }
            ]
        },
        {
            "id": 171,
            "seek": 96940,
            "start": 944.16,
            "end": 949.08,
            "text": " Thus, this is another piece of puzzle we missed until now.",
            "tokens": [
                50364,
                13827,
                11,
                341,
                307,
                1071,
                2522,
                295,
                12805,
                321,
                6721,
                1826,
                586,
                13,
                50614
            ],
            "temperature": 0.0,
            "avg_logprob": -0.23500844614731298,
            "compression_ratio": 1.5233160621761659,
            "no_speech_prob": 0.0033817291259765625,
            "words": [
                {
                    "start": 944.16,
                    "end": 944.56,
                    "word": " Thus",
                    "probability": 0.66845703125
                },
                {
                    "start": 944.56,
                    "end": 945.04,
                    "word": ",",
                    "probability": 0.8349609375
                },
                {
                    "start": 945.04,
                    "end": 945.3,
                    "word": " this",
                    "probability": 0.8681640625
                },
                {
                    "start": 945.3,
                    "end": 945.44,
                    "word": " is",
                    "probability": 0.9013671875
                },
                {
                    "start": 945.44,
                    "end": 945.72,
                    "word": " another",
                    "probability": 0.80859375
                },
                {
                    "start": 945.72,
                    "end": 946.04,
                    "word": " piece",
                    "probability": 0.794921875
                },
                {
                    "start": 946.04,
                    "end": 946.2,
                    "word": " of",
                    "probability": 0.9052734375
                },
                {
                    "start": 946.2,
                    "end": 946.6,
                    "word": " puzzle",
                    "probability": 0.55615234375
                },
                {
                    "start": 946.6,
                    "end": 947.22,
                    "word": " we",
                    "probability": 0.875
                },
                {
                    "start": 947.22,
                    "end": 947.5,
                    "word": " missed",
                    "probability": 0.7998046875
                },
                {
                    "start": 947.5,
                    "end": 947.94,
                    "word": " until",
                    "probability": 0.77392578125
                },
                {
                    "start": 947.94,
                    "end": 948.28,
                    "word": " now",
                    "probability": 0.89404296875
                },
                {
                    "start": 948.28,
                    "end": 949.08,
                    "word": ".",
                    "probability": 0.9892578125
                }
            ]
        },
        {
            "id": 172,
            "seek": 96940,
            "start": 949.52,
            "end": 955.0,
            "text": " Second batch file, called sn.bat, was unpacker.",
            "tokens": [
                50614,
                5736,
                15245,
                3991,
                11,
                1219,
                2406,
                13,
                11980,
                11,
                390,
                26699,
                260,
                13,
                50914
            ],
            "temperature": 0.0,
            "avg_logprob": -0.23500844614731298,
            "compression_ratio": 1.5233160621761659,
            "no_speech_prob": 0.0033817291259765625,
            "words": [
                {
                    "start": 949.52,
                    "end": 950.02,
                    "word": " Second",
                    "probability": 0.490234375
                },
                {
                    "start": 950.02,
                    "end": 950.32,
                    "word": " batch",
                    "probability": 0.79150390625
                },
                {
                    "start": 950.32,
                    "end": 950.7,
                    "word": " file",
                    "probability": 0.78076171875
                },
                {
                    "start": 950.7,
                    "end": 951.42,
                    "word": ",",
                    "probability": 0.3046875
                },
                {
                    "start": 951.42,
                    "end": 951.78,
                    "word": " called",
                    "probability": 0.80615234375
                },
                {
                    "start": 951.78,
                    "end": 952.38,
                    "word": " sn",
                    "probability": 0.50439453125
                },
                {
                    "start": 952.38,
                    "end": 953.0,
                    "word": ".bat",
                    "probability": 0.777099609375
                },
                {
                    "start": 953.0,
                    "end": 953.22,
                    "word": ",",
                    "probability": 0.76953125
                },
                {
                    "start": 953.22,
                    "end": 953.86,
                    "word": " was",
                    "probability": 0.89013671875
                },
                {
                    "start": 953.86,
                    "end": 954.38,
                    "word": " unpacker",
                    "probability": 0.743896484375
                },
                {
                    "start": 954.38,
                    "end": 955.0,
                    "word": ".",
                    "probability": 0.98388671875
                }
            ]
        },
        {
            "id": 173,
            "seek": 96940,
            "start": 955.0,
            "end": 962.04,
            "text": " It also seemed that the coin miners malicious stuff originally came as a package called set.zip.",
            "tokens": [
                50914,
                467,
                611,
                6576,
                300,
                264,
                11464,
                35640,
                33496,
                1507,
                7993,
                1361,
                382,
                257,
                7372,
                1219,
                992,
                13,
                27268,
                13,
                51264
            ],
            "temperature": 0.0,
            "avg_logprob": -0.23500844614731298,
            "compression_ratio": 1.5233160621761659,
            "no_speech_prob": 0.0033817291259765625,
            "words": [
                {
                    "start": 955.0,
                    "end": 955.18,
                    "word": " It",
                    "probability": 0.9013671875
                },
                {
                    "start": 955.18,
                    "end": 955.46,
                    "word": " also",
                    "probability": 0.81689453125
                },
                {
                    "start": 955.46,
                    "end": 955.86,
                    "word": " seemed",
                    "probability": 0.720703125
                },
                {
                    "start": 955.86,
                    "end": 956.36,
                    "word": " that",
                    "probability": 0.85595703125
                },
                {
                    "start": 956.36,
                    "end": 956.56,
                    "word": " the",
                    "probability": 0.79736328125
                },
                {
                    "start": 956.56,
                    "end": 956.8,
                    "word": " coin",
                    "probability": 0.65380859375
                },
                {
                    "start": 956.8,
                    "end": 957.26,
                    "word": " miners",
                    "probability": 0.370849609375
                },
                {
                    "start": 957.26,
                    "end": 957.7,
                    "word": " malicious",
                    "probability": 0.77197265625
                },
                {
                    "start": 957.7,
                    "end": 958.1,
                    "word": " stuff",
                    "probability": 0.8310546875
                },
                {
                    "start": 958.1,
                    "end": 958.64,
                    "word": " originally",
                    "probability": 0.5263671875
                },
                {
                    "start": 958.64,
                    "end": 959.08,
                    "word": " came",
                    "probability": 0.8212890625
                },
                {
                    "start": 959.08,
                    "end": 959.36,
                    "word": " as",
                    "probability": 0.88720703125
                },
                {
                    "start": 959.4,
                    "end": 959.72,
                    "word": " a package",
                    "probability": 0.8779296875
                },
                {
                    "start": 959.72,
                    "end": 960.18,
                    "word": " called",
                    "probability": 0.8310546875
                },
                {
                    "start": 960.18,
                    "end": 960.78,
                    "word": " set",
                    "probability": 0.76123046875
                },
                {
                    "start": 960.78,
                    "end": 961.24,
                    "word": ".zip",
                    "probability": 0.951416015625
                },
                {
                    "start": 961.24,
                    "end": 962.04,
                    "word": ".",
                    "probability": 0.9541015625
                }
            ]
        },
        {
            "id": 174,
            "seek": 96940,
            "start": 962.32,
            "end": 973.06,
            "text": " We also saw that this installation batch script was executed via a program called let.exe.",
            "tokens": [
                51264,
                492,
                611,
                1866,
                300,
                341,
                13260,
                15245,
                5755,
                390,
                17577,
                5766,
                257,
                1461,
                1219,
                718,
                13,
                3121,
                68,
                13,
                51814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.23500844614731298,
            "compression_ratio": 1.5233160621761659,
            "no_speech_prob": 0.0033817291259765625,
            "words": [
                {
                    "start": 962.32,
                    "end": 962.46,
                    "word": " We",
                    "probability": 0.9013671875
                },
                {
                    "start": 962.46,
                    "end": 962.72,
                    "word": " also",
                    "probability": 0.814453125
                },
                {
                    "start": 962.72,
                    "end": 963.12,
                    "word": " saw",
                    "probability": 0.7978515625
                },
                {
                    "start": 963.12,
                    "end": 966.3,
                    "word": " that",
                    "probability": 0.63720703125
                },
                {
                    "start": 966.3,
                    "end": 967.6,
                    "word": " this",
                    "probability": 0.69580078125
                },
                {
                    "start": 967.6,
                    "end": 968.0,
                    "word": " installation",
                    "probability": 0.90087890625
                },
                {
                    "start": 968.0,
                    "end": 968.34,
                    "word": " batch",
                    "probability": 0.66259765625
                },
                {
                    "start": 968.34,
                    "end": 968.7,
                    "word": " script",
                    "probability": 0.7626953125
                },
                {
                    "start": 968.7,
                    "end": 969.26,
                    "word": " was",
                    "probability": 0.87744140625
                },
                {
                    "start": 969.26,
                    "end": 969.76,
                    "word": " executed",
                    "probability": 0.88916015625
                },
                {
                    "start": 969.76,
                    "end": 970.14,
                    "word": " via",
                    "probability": 0.76611328125
                },
                {
                    "start": 970.3,
                    "end": 970.62,
                    "word": " a program",
                    "probability": 0.759765625
                },
                {
                    "start": 970.62,
                    "end": 971.1,
                    "word": " called",
                    "probability": 0.8056640625
                },
                {
                    "start": 971.1,
                    "end": 971.52,
                    "word": " let",
                    "probability": 0.755859375
                },
                {
                    "start": 971.52,
                    "end": 972.42,
                    "word": ".exe",
                    "probability": 0.970703125
                },
                {
                    "start": 972.42,
                    "end": 973.06,
                    "word": ".",
                    "probability": 0.79833984375
                }
            ]
        },
        {
            "id": 175,
            "seek": 99880,
            "start": 973.06,
            "end": 980.04,
            "text": " But what was the let.exe and what files did the set.zip contain?",
            "tokens": [
                50364,
                583,
                437,
                390,
                264,
                718,
                13,
                3121,
                68,
                293,
                437,
                7098,
                630,
                264,
                992,
                13,
                27268,
                5304,
                30,
                50714
            ],
            "temperature": 0.0,
            "avg_logprob": -0.16661510609164096,
            "compression_ratio": 1.6266666666666667,
            "no_speech_prob": 0.007320404052734375,
            "words": [
                {
                    "start": 973.06,
                    "end": 973.54,
                    "word": " But",
                    "probability": 0.57763671875
                },
                {
                    "start": 973.54,
                    "end": 974.32,
                    "word": " what",
                    "probability": 0.763671875
                },
                {
                    "start": 974.32,
                    "end": 974.9,
                    "word": " was",
                    "probability": 0.8828125
                },
                {
                    "start": 974.9,
                    "end": 975.32,
                    "word": " the",
                    "probability": 0.7392578125
                },
                {
                    "start": 975.32,
                    "end": 975.48,
                    "word": " let",
                    "probability": 0.6025390625
                },
                {
                    "start": 975.48,
                    "end": 976.2,
                    "word": ".exe",
                    "probability": 0.94189453125
                },
                {
                    "start": 976.2,
                    "end": 977.04,
                    "word": " and",
                    "probability": 0.63330078125
                },
                {
                    "start": 977.04,
                    "end": 977.7,
                    "word": " what",
                    "probability": 0.88623046875
                },
                {
                    "start": 977.7,
                    "end": 978.28,
                    "word": " files",
                    "probability": 0.806640625
                },
                {
                    "start": 978.28,
                    "end": 978.56,
                    "word": " did",
                    "probability": 0.87646484375
                },
                {
                    "start": 978.56,
                    "end": 978.78,
                    "word": " the",
                    "probability": 0.794921875
                },
                {
                    "start": 978.78,
                    "end": 978.96,
                    "word": " set",
                    "probability": 0.46923828125
                },
                {
                    "start": 978.96,
                    "end": 979.14,
                    "word": ".zip",
                    "probability": 0.5238037109375
                },
                {
                    "start": 979.14,
                    "end": 979.68,
                    "word": " contain",
                    "probability": 0.82470703125
                },
                {
                    "start": 979.68,
                    "end": 980.04,
                    "word": "?",
                    "probability": 0.96435546875
                }
            ]
        },
        {
            "id": 176,
            "seek": 99880,
            "start": 980.04,
            "end": 982.04,
            "text": " We didn't find them yet.",
            "tokens": [
                50714,
                492,
                994,
                380,
                915,
                552,
                1939,
                13,
                50814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.16661510609164096,
            "compression_ratio": 1.6266666666666667,
            "no_speech_prob": 0.007320404052734375,
            "words": [
                {
                    "start": 980.04,
                    "end": 980.42,
                    "word": " We",
                    "probability": 0.90283203125
                },
                {
                    "start": 980.42,
                    "end": 980.7,
                    "word": " didn't",
                    "probability": 0.914306640625
                },
                {
                    "start": 980.7,
                    "end": 981.02,
                    "word": " find",
                    "probability": 0.83056640625
                },
                {
                    "start": 981.02,
                    "end": 981.26,
                    "word": " them",
                    "probability": 0.701171875
                },
                {
                    "start": 981.26,
                    "end": 981.52,
                    "word": " yet",
                    "probability": 0.89892578125
                },
                {
                    "start": 981.52,
                    "end": 982.04,
                    "word": ".",
                    "probability": 0.78125
                }
            ]
        },
        {
            "id": 177,
            "seek": 99880,
            "start": 982.04,
            "end": 983.62,
            "text": " So, let's continue.",
            "tokens": [
                50814,
                407,
                11,
                718,
                311,
                2354,
                13,
                50914
            ],
            "temperature": 0.0,
            "avg_logprob": -0.16661510609164096,
            "compression_ratio": 1.6266666666666667,
            "no_speech_prob": 0.007320404052734375,
            "words": [
                {
                    "start": 982.04,
                    "end": 982.34,
                    "word": " So",
                    "probability": 0.83740234375
                },
                {
                    "start": 982.34,
                    "end": 982.46,
                    "word": ",",
                    "probability": 0.307861328125
                },
                {
                    "start": 982.46,
                    "end": 982.6,
                    "word": " let's",
                    "probability": 0.9423828125
                },
                {
                    "start": 982.6,
                    "end": 982.98,
                    "word": " continue",
                    "probability": 0.80712890625
                },
                {
                    "start": 982.98,
                    "end": 983.62,
                    "word": ".",
                    "probability": 0.97509765625
                }
            ]
        },
        {
            "id": 178,
            "seek": 99880,
            "start": 984.52,
            "end": 992.4,
            "text": " We applied the same approach again and we tried to do a reconnaissance about let.exe and installation package.",
            "tokens": [
                50914,
                492,
                6456,
                264,
                912,
                3109,
                797,
                293,
                321,
                3031,
                281,
                360,
                257,
                31073,
                14431,
                466,
                718,
                13,
                3121,
                68,
                293,
                13260,
                7372,
                13,
                51314
            ],
            "temperature": 0.0,
            "avg_logprob": -0.16661510609164096,
            "compression_ratio": 1.6266666666666667,
            "no_speech_prob": 0.007320404052734375,
            "words": [
                {
                    "start": 984.52,
                    "end": 985.16,
                    "word": " We",
                    "probability": 0.9052734375
                },
                {
                    "start": 985.16,
                    "end": 985.56,
                    "word": " applied",
                    "probability": 0.71533203125
                },
                {
                    "start": 985.56,
                    "end": 985.8,
                    "word": " the",
                    "probability": 0.802734375
                },
                {
                    "start": 985.8,
                    "end": 985.98,
                    "word": " same",
                    "probability": 0.8125
                },
                {
                    "start": 985.98,
                    "end": 986.38,
                    "word": " approach",
                    "probability": 0.80322265625
                },
                {
                    "start": 986.38,
                    "end": 986.86,
                    "word": " again",
                    "probability": 0.916015625
                },
                {
                    "start": 986.86,
                    "end": 987.18,
                    "word": " and",
                    "probability": 0.58447265625
                },
                {
                    "start": 987.18,
                    "end": 987.32,
                    "word": " we",
                    "probability": 0.89453125
                },
                {
                    "start": 987.32,
                    "end": 987.62,
                    "word": " tried",
                    "probability": 0.6943359375
                },
                {
                    "start": 987.62,
                    "end": 987.8,
                    "word": " to",
                    "probability": 0.90869140625
                },
                {
                    "start": 987.8,
                    "end": 988.02,
                    "word": " do",
                    "probability": 0.89404296875
                },
                {
                    "start": 988.22,
                    "end": 988.84,
                    "word": " a reconnaissance",
                    "probability": 0.87744140625
                },
                {
                    "start": 988.84,
                    "end": 989.42,
                    "word": " about",
                    "probability": 0.8056640625
                },
                {
                    "start": 989.42,
                    "end": 990.12,
                    "word": " let",
                    "probability": 0.837890625
                },
                {
                    "start": 990.12,
                    "end": 990.82,
                    "word": ".exe",
                    "probability": 0.9617513020833334
                },
                {
                    "start": 990.82,
                    "end": 991.08,
                    "word": " and",
                    "probability": 0.88232421875
                },
                {
                    "start": 991.08,
                    "end": 991.56,
                    "word": " installation",
                    "probability": 0.86328125
                },
                {
                    "start": 991.56,
                    "end": 991.98,
                    "word": " package",
                    "probability": 0.88330078125
                },
                {
                    "start": 991.98,
                    "end": 992.4,
                    "word": ".",
                    "probability": 0.9853515625
                }
            ]
        },
        {
            "id": 179,
            "seek": 99880,
            "start": 992.4,
            "end": 999.4,
            "text": " In some cases, we were able to follow tracks of the let.exe execution in public sources.",
            "tokens": [
                51314,
                682,
                512,
                3331,
                11,
                321,
                645,
                1075,
                281,
                1524,
                10218,
                295,
                264,
                718,
                13,
                3121,
                68,
                15058,
                294,
                1908,
                7139,
                13,
                51664
            ],
            "temperature": 0.0,
            "avg_logprob": -0.16661510609164096,
            "compression_ratio": 1.6266666666666667,
            "no_speech_prob": 0.007320404052734375,
            "words": [
                {
                    "start": 992.4,
                    "end": 992.52,
                    "word": " In",
                    "probability": 0.90234375
                },
                {
                    "start": 992.52,
                    "end": 992.72,
                    "word": " some",
                    "probability": 0.82275390625
                },
                {
                    "start": 992.72,
                    "end": 993.16,
                    "word": " cases",
                    "probability": 0.80322265625
                },
                {
                    "start": 993.16,
                    "end": 993.32,
                    "word": ",",
                    "probability": 0.85498046875
                },
                {
                    "start": 993.32,
                    "end": 993.42,
                    "word": " we",
                    "probability": 0.8896484375
                },
                {
                    "start": 993.42,
                    "end": 993.58,
                    "word": " were",
                    "probability": 0.857421875
                },
                {
                    "start": 993.58,
                    "end": 993.94,
                    "word": " able",
                    "probability": 0.87890625
                },
                {
                    "start": 993.94,
                    "end": 994.24,
                    "word": " to",
                    "probability": 0.90625
                },
                {
                    "start": 994.24,
                    "end": 994.5,
                    "word": " follow",
                    "probability": 0.86181640625
                },
                {
                    "start": 994.5,
                    "end": 994.86,
                    "word": " tracks",
                    "probability": 0.496826171875
                },
                {
                    "start": 994.86,
                    "end": 995.22,
                    "word": " of",
                    "probability": 0.89453125
                },
                {
                    "start": 995.22,
                    "end": 995.86,
                    "word": " the",
                    "probability": 0.8076171875
                },
                {
                    "start": 995.86,
                    "end": 996.06,
                    "word": " let",
                    "probability": 0.8974609375
                },
                {
                    "start": 996.06,
                    "end": 996.76,
                    "word": ".exe",
                    "probability": 0.9567057291666666
                },
                {
                    "start": 996.76,
                    "end": 997.44,
                    "word": " execution",
                    "probability": 0.7880859375
                },
                {
                    "start": 997.44,
                    "end": 998.18,
                    "word": " in",
                    "probability": 0.892578125
                },
                {
                    "start": 998.18,
                    "end": 998.44,
                    "word": " public",
                    "probability": 0.83642578125
                },
                {
                    "start": 998.44,
                    "end": 998.8,
                    "word": " sources",
                    "probability": 0.71142578125
                },
                {
                    "start": 998.8,
                    "end": 999.4,
                    "word": ".",
                    "probability": 0.98876953125
                }
            ]
        },
        {
            "id": 180,
            "seek": 99880,
            "start": 999.4,
            "end": 1002.46,
            "text": " It seemed that it was a kind of local privilege exploit.",
            "tokens": [
                51664,
                467,
                6576,
                300,
                309,
                390,
                257,
                733,
                295,
                2654,
                12122,
                25924,
                13,
                51814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.16661510609164096,
            "compression_ratio": 1.6266666666666667,
            "no_speech_prob": 0.007320404052734375,
            "words": [
                {
                    "start": 999.4,
                    "end": 999.6,
                    "word": " It",
                    "probability": 0.90478515625
                },
                {
                    "start": 999.6,
                    "end": 999.92,
                    "word": " seemed",
                    "probability": 0.7978515625
                },
                {
                    "start": 999.92,
                    "end": 1000.2,
                    "word": " that",
                    "probability": 0.873046875
                },
                {
                    "start": 1000.2,
                    "end": 1000.36,
                    "word": " it",
                    "probability": 0.89990234375
                },
                {
                    "start": 1000.36,
                    "end": 1000.6,
                    "word": " was",
                    "probability": 0.8935546875
                },
                {
                    "start": 1000.74,
                    "end": 1000.98,
                    "word": " a kind",
                    "probability": 0.79248046875
                },
                {
                    "start": 1000.98,
                    "end": 1001.14,
                    "word": " of",
                    "probability": 0.90087890625
                },
                {
                    "start": 1001.14,
                    "end": 1001.4,
                    "word": " local",
                    "probability": 0.76708984375
                },
                {
                    "start": 1001.4,
                    "end": 1001.76,
                    "word": " privilege",
                    "probability": 0.6220703125
                },
                {
                    "start": 1001.76,
                    "end": 1002.28,
                    "word": " exploit",
                    "probability": 0.755859375
                },
                {
                    "start": 1002.28,
                    "end": 1002.46,
                    "word": ".",
                    "probability": 0.95703125
                }
            ]
        },
        {
            "id": 181,
            "seek": 102548,
            "start": 1002.46,
            "end": 1009.56,
            "text": " Then, suddenly, we found the one submission of set.zip on hybrid analysis.",
            "tokens": [
                50364,
                1396,
                11,
                5800,
                11,
                321,
                1352,
                264,
                472,
                23689,
                295,
                992,
                13,
                27268,
                322,
                13051,
                5215,
                13,
                50714
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2065746815173657,
            "compression_ratio": 1.566326530612245,
            "no_speech_prob": 0.0294647216796875,
            "words": [
                {
                    "start": 1002.46,
                    "end": 1003.16,
                    "word": " Then",
                    "probability": 0.66552734375
                },
                {
                    "start": 1003.16,
                    "end": 1003.38,
                    "word": ",",
                    "probability": 0.5400390625
                },
                {
                    "start": 1003.38,
                    "end": 1003.78,
                    "word": " suddenly",
                    "probability": 0.7431640625
                },
                {
                    "start": 1003.78,
                    "end": 1004.42,
                    "word": ",",
                    "probability": 0.82958984375
                },
                {
                    "start": 1004.42,
                    "end": 1004.54,
                    "word": " we",
                    "probability": 0.89306640625
                },
                {
                    "start": 1004.54,
                    "end": 1005.56,
                    "word": " found",
                    "probability": 0.8095703125
                },
                {
                    "start": 1005.56,
                    "end": 1005.76,
                    "word": " the",
                    "probability": 0.68994140625
                },
                {
                    "start": 1005.76,
                    "end": 1005.96,
                    "word": " one",
                    "probability": 0.52490234375
                },
                {
                    "start": 1005.96,
                    "end": 1006.34,
                    "word": " submission",
                    "probability": 0.80419921875
                },
                {
                    "start": 1006.34,
                    "end": 1006.74,
                    "word": " of",
                    "probability": 0.88623046875
                },
                {
                    "start": 1006.74,
                    "end": 1006.96,
                    "word": " set",
                    "probability": 0.5537109375
                },
                {
                    "start": 1006.96,
                    "end": 1007.36,
                    "word": ".zip",
                    "probability": 0.9375
                },
                {
                    "start": 1007.36,
                    "end": 1008.02,
                    "word": " on",
                    "probability": 0.89404296875
                },
                {
                    "start": 1008.02,
                    "end": 1008.32,
                    "word": " hybrid",
                    "probability": 0.666015625
                },
                {
                    "start": 1008.32,
                    "end": 1008.8,
                    "word": " analysis",
                    "probability": 0.63818359375
                },
                {
                    "start": 1008.8,
                    "end": 1009.56,
                    "word": ".",
                    "probability": 0.66650390625
                }
            ]
        },
        {
            "id": 182,
            "seek": 102548,
            "start": 1009.72,
            "end": 1014.34,
            "text": " And this submission could be related to our investigation.",
            "tokens": [
                50714,
                400,
                341,
                23689,
                727,
                312,
                4077,
                281,
                527,
                9627,
                13,
                50964
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2065746815173657,
            "compression_ratio": 1.566326530612245,
            "no_speech_prob": 0.0294647216796875,
            "words": [
                {
                    "start": 1009.72,
                    "end": 1009.9,
                    "word": " And",
                    "probability": 0.69482421875
                },
                {
                    "start": 1009.9,
                    "end": 1010.1,
                    "word": " this",
                    "probability": 0.673828125
                },
                {
                    "start": 1010.1,
                    "end": 1010.6,
                    "word": " submission",
                    "probability": 0.8330078125
                },
                {
                    "start": 1010.6,
                    "end": 1011.34,
                    "word": " could",
                    "probability": 0.78369140625
                },
                {
                    "start": 1011.34,
                    "end": 1011.7,
                    "word": " be",
                    "probability": 0.896484375
                },
                {
                    "start": 1011.7,
                    "end": 1012.2,
                    "word": " related",
                    "probability": 0.84326171875
                },
                {
                    "start": 1012.2,
                    "end": 1012.44,
                    "word": " to",
                    "probability": 0.90380859375
                },
                {
                    "start": 1012.44,
                    "end": 1012.82,
                    "word": " our",
                    "probability": 0.8193359375
                },
                {
                    "start": 1012.82,
                    "end": 1013.58,
                    "word": " investigation",
                    "probability": 0.71630859375
                },
                {
                    "start": 1013.58,
                    "end": 1014.34,
                    "word": ".",
                    "probability": 0.9326171875
                }
            ]
        },
        {
            "id": 183,
            "seek": 102548,
            "start": 1014.36,
            "end": 1020.62,
            "text": " And yes, this file was exactly the one we were hunting for, the installation package.",
            "tokens": [
                50964,
                400,
                2086,
                11,
                341,
                3991,
                390,
                2293,
                264,
                472,
                321,
                645,
                12599,
                337,
                11,
                264,
                13260,
                7372,
                13,
                51264
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2065746815173657,
            "compression_ratio": 1.566326530612245,
            "no_speech_prob": 0.0294647216796875,
            "words": [
                {
                    "start": 1014.36,
                    "end": 1014.48,
                    "word": " And",
                    "probability": 0.875
                },
                {
                    "start": 1014.48,
                    "end": 1014.78,
                    "word": " yes",
                    "probability": 0.72900390625
                },
                {
                    "start": 1014.78,
                    "end": 1015.18,
                    "word": ",",
                    "probability": 0.939453125
                },
                {
                    "start": 1015.18,
                    "end": 1015.36,
                    "word": " this",
                    "probability": 0.86962890625
                },
                {
                    "start": 1015.36,
                    "end": 1015.62,
                    "word": " file",
                    "probability": 0.72998046875
                },
                {
                    "start": 1015.62,
                    "end": 1015.84,
                    "word": " was",
                    "probability": 0.88330078125
                },
                {
                    "start": 1015.84,
                    "end": 1016.32,
                    "word": " exactly",
                    "probability": 0.79248046875
                },
                {
                    "start": 1016.32,
                    "end": 1017.04,
                    "word": " the",
                    "probability": 0.810546875
                },
                {
                    "start": 1017.04,
                    "end": 1017.3,
                    "word": " one",
                    "probability": 0.81787109375
                },
                {
                    "start": 1017.3,
                    "end": 1017.5,
                    "word": " we",
                    "probability": 0.900390625
                },
                {
                    "start": 1017.5,
                    "end": 1017.66,
                    "word": " were",
                    "probability": 0.87890625
                },
                {
                    "start": 1017.66,
                    "end": 1017.98,
                    "word": " hunting",
                    "probability": 0.779296875
                },
                {
                    "start": 1017.98,
                    "end": 1018.4,
                    "word": " for",
                    "probability": 0.89599609375
                },
                {
                    "start": 1018.4,
                    "end": 1018.86,
                    "word": ",",
                    "probability": 0.58251953125
                },
                {
                    "start": 1018.86,
                    "end": 1019.0,
                    "word": " the",
                    "probability": 0.80908203125
                },
                {
                    "start": 1019.0,
                    "end": 1019.38,
                    "word": " installation",
                    "probability": 0.8798828125
                },
                {
                    "start": 1019.38,
                    "end": 1019.86,
                    "word": " package",
                    "probability": 0.1905517578125
                },
                {
                    "start": 1019.86,
                    "end": 1020.62,
                    "word": ".",
                    "probability": 0.95849609375
                }
            ]
        },
        {
            "id": 184,
            "seek": 102548,
            "start": 1020.88,
            "end": 1024.04,
            "text": " And the program let.exe was included.",
            "tokens": [
                51264,
                400,
                264,
                1461,
                718,
                13,
                3121,
                68,
                390,
                5556,
                13,
                51464
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2065746815173657,
            "compression_ratio": 1.566326530612245,
            "no_speech_prob": 0.0294647216796875,
            "words": [
                {
                    "start": 1020.88,
                    "end": 1021.1,
                    "word": " And",
                    "probability": 0.859375
                },
                {
                    "start": 1021.1,
                    "end": 1021.26,
                    "word": " the",
                    "probability": 0.8134765625
                },
                {
                    "start": 1021.26,
                    "end": 1021.68,
                    "word": " program",
                    "probability": 0.75732421875
                },
                {
                    "start": 1021.68,
                    "end": 1021.96,
                    "word": " let",
                    "probability": 0.70068359375
                },
                {
                    "start": 1021.96,
                    "end": 1022.6,
                    "word": ".exe",
                    "probability": 0.947265625
                },
                {
                    "start": 1022.6,
                    "end": 1022.88,
                    "word": " was",
                    "probability": 0.86767578125
                },
                {
                    "start": 1022.88,
                    "end": 1023.28,
                    "word": " included",
                    "probability": 0.81689453125
                },
                {
                    "start": 1023.28,
                    "end": 1024.04,
                    "word": ".",
                    "probability": 0.892578125
                }
            ]
        },
        {
            "id": 185,
            "seek": 102548,
            "start": 1024.18,
            "end": 1029.14,
            "text": " As it turned out that our hypothesis was correct.",
            "tokens": [
                51464,
                1018,
                309,
                3574,
                484,
                300,
                527,
                17291,
                390,
                3006,
                13,
                51714
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2065746815173657,
            "compression_ratio": 1.566326530612245,
            "no_speech_prob": 0.0294647216796875,
            "words": [
                {
                    "start": 1024.18,
                    "end": 1024.44,
                    "word": " As",
                    "probability": 0.8857421875
                },
                {
                    "start": 1024.44,
                    "end": 1024.58,
                    "word": " it",
                    "probability": 0.908203125
                },
                {
                    "start": 1024.58,
                    "end": 1024.84,
                    "word": " turned",
                    "probability": 0.7685546875
                },
                {
                    "start": 1024.84,
                    "end": 1025.26,
                    "word": " out",
                    "probability": 0.82470703125
                },
                {
                    "start": 1025.26,
                    "end": 1026.88,
                    "word": " that",
                    "probability": 0.50244140625
                },
                {
                    "start": 1026.88,
                    "end": 1027.2,
                    "word": " our",
                    "probability": 0.83251953125
                },
                {
                    "start": 1027.2,
                    "end": 1027.64,
                    "word": " hypothesis",
                    "probability": 0.6025390625
                },
                {
                    "start": 1027.64,
                    "end": 1027.96,
                    "word": " was",
                    "probability": 0.888671875
                },
                {
                    "start": 1027.96,
                    "end": 1028.38,
                    "word": " correct",
                    "probability": 0.8623046875
                },
                {
                    "start": 1028.38,
                    "end": 1029.14,
                    "word": ".",
                    "probability": 0.68798828125
                }
            ]
        },
        {
            "id": 186,
            "seek": 105252,
            "start": 1029.14,
            "end": 1038.1,
            "text": " The program let.exe was the juicy potato local privilege exploit with source codes available on GitHub.",
            "tokens": [
                50364,
                440,
                1461,
                718,
                13,
                3121,
                68,
                390,
                264,
                24696,
                7445,
                2654,
                12122,
                25924,
                365,
                4009,
                14211,
                2435,
                322,
                23331,
                13,
                50814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.30825617872638467,
            "compression_ratio": 1.4361702127659575,
            "no_speech_prob": 0.036834716796875,
            "words": [
                {
                    "start": 1029.14,
                    "end": 1030.2,
                    "word": " The",
                    "probability": 0.61279296875
                },
                {
                    "start": 1030.2,
                    "end": 1030.72,
                    "word": " program",
                    "probability": 0.71630859375
                },
                {
                    "start": 1030.72,
                    "end": 1031.24,
                    "word": " let",
                    "probability": 0.2039794921875
                },
                {
                    "start": 1031.24,
                    "end": 1032.08,
                    "word": ".exe",
                    "probability": 0.93994140625
                },
                {
                    "start": 1032.08,
                    "end": 1032.64,
                    "word": " was",
                    "probability": 0.85302734375
                },
                {
                    "start": 1032.64,
                    "end": 1032.82,
                    "word": " the",
                    "probability": 0.775390625
                },
                {
                    "start": 1032.82,
                    "end": 1033.06,
                    "word": " juicy",
                    "probability": 0.88818359375
                },
                {
                    "start": 1033.06,
                    "end": 1033.58,
                    "word": " potato",
                    "probability": 0.85400390625
                },
                {
                    "start": 1033.58,
                    "end": 1034.04,
                    "word": " local",
                    "probability": 0.74560546875
                },
                {
                    "start": 1034.04,
                    "end": 1034.48,
                    "word": " privilege",
                    "probability": 0.62939453125
                },
                {
                    "start": 1034.48,
                    "end": 1035.0,
                    "word": " exploit",
                    "probability": 0.845703125
                },
                {
                    "start": 1035.0,
                    "end": 1035.8,
                    "word": " with",
                    "probability": 0.63818359375
                },
                {
                    "start": 1035.8,
                    "end": 1036.1,
                    "word": " source",
                    "probability": 0.60302734375
                },
                {
                    "start": 1036.1,
                    "end": 1036.42,
                    "word": " codes",
                    "probability": 0.450927734375
                },
                {
                    "start": 1036.42,
                    "end": 1036.98,
                    "word": " available",
                    "probability": 0.75146484375
                },
                {
                    "start": 1036.98,
                    "end": 1037.3,
                    "word": " on",
                    "probability": 0.88134765625
                },
                {
                    "start": 1037.3,
                    "end": 1037.52,
                    "word": " GitHub",
                    "probability": 0.7294921875
                },
                {
                    "start": 1037.52,
                    "end": 1038.1,
                    "word": ".",
                    "probability": 0.8076171875
                }
            ]
        },
        {
            "id": 187,
            "seek": 105252,
            "start": 1038.1,
            "end": 1040.6,
            "text": " Again. Again on GitHub.",
            "tokens": [
                50814,
                3764,
                13,
                3764,
                322,
                23331,
                13,
                50964
            ],
            "temperature": 0.0,
            "avg_logprob": -0.30825617872638467,
            "compression_ratio": 1.4361702127659575,
            "no_speech_prob": 0.036834716796875,
            "words": [
                {
                    "start": 1038.1,
                    "end": 1038.5,
                    "word": " Again",
                    "probability": 0.876953125
                },
                {
                    "start": 1038.5,
                    "end": 1039.0,
                    "word": ".",
                    "probability": 0.201416015625
                },
                {
                    "start": 1039.0,
                    "end": 1039.3,
                    "word": " Again",
                    "probability": 0.853515625
                },
                {
                    "start": 1039.3,
                    "end": 1039.54,
                    "word": " on",
                    "probability": 0.78857421875
                },
                {
                    "start": 1039.54,
                    "end": 1039.76,
                    "word": " GitHub",
                    "probability": 0.88525390625
                },
                {
                    "start": 1039.76,
                    "end": 1040.6,
                    "word": ".",
                    "probability": 0.982421875
                }
            ]
        },
        {
            "id": 188,
            "seek": 105252,
            "start": 1043.89,
            "end": 1047.37,
            "text": " There left only last sample.",
            "tokens": [
                50964,
                821,
                1411,
                787,
                1036,
                6889,
                13,
                51164
            ],
            "temperature": 0.0,
            "avg_logprob": -0.30825617872638467,
            "compression_ratio": 1.4361702127659575,
            "no_speech_prob": 0.036834716796875,
            "words": [
                {
                    "start": 1043.89,
                    "end": 1044.13,
                    "word": " There",
                    "probability": 0.482666015625
                },
                {
                    "start": 1044.13,
                    "end": 1045.25,
                    "word": " left",
                    "probability": 0.427734375
                },
                {
                    "start": 1045.25,
                    "end": 1045.87,
                    "word": " only",
                    "probability": 0.841796875
                },
                {
                    "start": 1045.87,
                    "end": 1046.57,
                    "word": " last",
                    "probability": 0.70703125
                },
                {
                    "start": 1046.57,
                    "end": 1046.95,
                    "word": " sample",
                    "probability": 0.82421875
                },
                {
                    "start": 1046.95,
                    "end": 1047.37,
                    "word": ".",
                    "probability": 0.480224609375
                }
            ]
        },
        {
            "id": 189,
            "seek": 105252,
            "start": 1047.89,
            "end": 1050.43,
            "text": " We don't analyze it until now.",
            "tokens": [
                51164,
                492,
                500,
                380,
                12477,
                309,
                1826,
                586,
                13,
                51314
            ],
            "temperature": 0.0,
            "avg_logprob": -0.30825617872638467,
            "compression_ratio": 1.4361702127659575,
            "no_speech_prob": 0.036834716796875,
            "words": [
                {
                    "start": 1047.89,
                    "end": 1047.89,
                    "word": " We",
                    "probability": 0.7763671875
                },
                {
                    "start": 1047.89,
                    "end": 1048.71,
                    "word": " don't",
                    "probability": 0.93994140625
                },
                {
                    "start": 1048.71,
                    "end": 1049.13,
                    "word": " analyze",
                    "probability": 0.63818359375
                },
                {
                    "start": 1049.13,
                    "end": 1049.25,
                    "word": " it",
                    "probability": 0.294189453125
                },
                {
                    "start": 1049.25,
                    "end": 1049.45,
                    "word": " until",
                    "probability": 0.69873046875
                },
                {
                    "start": 1049.45,
                    "end": 1049.75,
                    "word": " now",
                    "probability": 0.89453125
                },
                {
                    "start": 1049.75,
                    "end": 1050.43,
                    "word": ".",
                    "probability": 0.990234375
                }
            ]
        },
        {
            "id": 190,
            "seek": 105252,
            "start": 1050.43,
            "end": 1055.31,
            "text": " The nw.gold.dll from previous zip archive from any run.",
            "tokens": [
                51314,
                440,
                297,
                86,
                13,
                1571,
                348,
                13,
                67,
                285,
                490,
                3894,
                20730,
                23507,
                490,
                604,
                1190,
                13,
                51564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.30825617872638467,
            "compression_ratio": 1.4361702127659575,
            "no_speech_prob": 0.036834716796875,
            "words": [
                {
                    "start": 1050.43,
                    "end": 1050.61,
                    "word": " The",
                    "probability": 0.802734375
                },
                {
                    "start": 1050.61,
                    "end": 1051.17,
                    "word": " nw",
                    "probability": 0.757080078125
                },
                {
                    "start": 1051.17,
                    "end": 1051.89,
                    "word": ".gold",
                    "probability": 0.607177734375
                },
                {
                    "start": 1051.89,
                    "end": 1052.23,
                    "word": ".dll",
                    "probability": 0.93603515625
                },
                {
                    "start": 1052.23,
                    "end": 1052.69,
                    "word": " from",
                    "probability": 0.79638671875
                },
                {
                    "start": 1052.69,
                    "end": 1053.25,
                    "word": " previous",
                    "probability": 0.5361328125
                },
                {
                    "start": 1053.25,
                    "end": 1053.53,
                    "word": " zip",
                    "probability": 0.8271484375
                },
                {
                    "start": 1053.53,
                    "end": 1054.01,
                    "word": " archive",
                    "probability": 0.6572265625
                },
                {
                    "start": 1054.01,
                    "end": 1054.43,
                    "word": " from",
                    "probability": 0.8046875
                },
                {
                    "start": 1054.43,
                    "end": 1054.67,
                    "word": " any",
                    "probability": 0.2705078125
                },
                {
                    "start": 1054.67,
                    "end": 1054.89,
                    "word": " run",
                    "probability": 0.59912109375
                },
                {
                    "start": 1054.89,
                    "end": 1055.31,
                    "word": ".",
                    "probability": 0.96337890625
                }
            ]
        },
        {
            "id": 191,
            "seek": 105252,
            "start": 1055.69,
            "end": 1058.03,
            "text": " It was mixed-mod.dll file.",
            "tokens": [
                51564,
                467,
                390,
                7467,
                12,
                8014,
                13,
                67,
                285,
                3991,
                13,
                51714
            ],
            "temperature": 0.0,
            "avg_logprob": -0.30825617872638467,
            "compression_ratio": 1.4361702127659575,
            "no_speech_prob": 0.036834716796875,
            "words": [
                {
                    "start": 1055.69,
                    "end": 1055.87,
                    "word": " It",
                    "probability": 0.89453125
                },
                {
                    "start": 1055.87,
                    "end": 1056.11,
                    "word": " was",
                    "probability": 0.88330078125
                },
                {
                    "start": 1056.11,
                    "end": 1056.37,
                    "word": " mixed",
                    "probability": 0.720703125
                },
                {
                    "start": 1056.37,
                    "end": 1056.69,
                    "word": "-mod",
                    "probability": 0.3564453125
                },
                {
                    "start": 1056.69,
                    "end": 1057.09,
                    "word": ".dll",
                    "probability": 0.9187825520833334
                },
                {
                    "start": 1057.09,
                    "end": 1057.45,
                    "word": " file",
                    "probability": 0.81396484375
                },
                {
                    "start": 1057.45,
                    "end": 1058.03,
                    "word": ".",
                    "probability": 0.93115234375
                }
            ]
        },
        {
            "id": 192,
            "seek": 107790,
            "start": 1058.03,
            "end": 1062.13,
            "text": " Its name was composed from noun, timestamp, and architecture.",
            "tokens": [
                50364,
                6953,
                1315,
                390,
                18204,
                490,
                23307,
                11,
                49108,
                1215,
                11,
                293,
                9482,
                13,
                50564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2534722354676988,
            "compression_ratio": 1.4587155963302751,
            "no_speech_prob": 0.1396484375,
            "words": [
                {
                    "start": 1058.03,
                    "end": 1058.19,
                    "word": " Its",
                    "probability": 0.47314453125
                },
                {
                    "start": 1058.19,
                    "end": 1058.49,
                    "word": " name",
                    "probability": 0.82275390625
                },
                {
                    "start": 1058.49,
                    "end": 1058.71,
                    "word": " was",
                    "probability": 0.88525390625
                },
                {
                    "start": 1058.71,
                    "end": 1059.15,
                    "word": " composed",
                    "probability": 0.87646484375
                },
                {
                    "start": 1059.15,
                    "end": 1059.45,
                    "word": " from",
                    "probability": 0.806640625
                },
                {
                    "start": 1059.45,
                    "end": 1059.93,
                    "word": " noun",
                    "probability": 0.70166015625
                },
                {
                    "start": 1059.93,
                    "end": 1060.19,
                    "word": ",",
                    "probability": 0.845703125
                },
                {
                    "start": 1060.19,
                    "end": 1060.69,
                    "word": " timestamp",
                    "probability": 0.906982421875
                },
                {
                    "start": 1060.69,
                    "end": 1060.85,
                    "word": ",",
                    "probability": 0.54248046875
                },
                {
                    "start": 1060.85,
                    "end": 1060.95,
                    "word": " and",
                    "probability": 0.8955078125
                },
                {
                    "start": 1060.95,
                    "end": 1061.45,
                    "word": " architecture",
                    "probability": 0.822265625
                },
                {
                    "start": 1061.45,
                    "end": 1062.13,
                    "word": ".",
                    "probability": 0.86572265625
                }
            ]
        },
        {
            "id": 193,
            "seek": 107790,
            "start": 1062.45,
            "end": 1071.67,
            "text": " And the managed code contains only empty .NET class, while the native code contains a dropper of unpacker batch file we saw before.",
            "tokens": [
                50564,
                400,
                264,
                6453,
                3089,
                8306,
                787,
                6707,
                2411,
                35554,
                1508,
                11,
                1339,
                264,
                8470,
                3089,
                8306,
                257,
                3789,
                3717,
                295,
                26699,
                260,
                15245,
                3991,
                321,
                1866,
                949,
                13,
                51014
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2534722354676988,
            "compression_ratio": 1.4587155963302751,
            "no_speech_prob": 0.1396484375,
            "words": [
                {
                    "start": 1062.45,
                    "end": 1062.57,
                    "word": " And",
                    "probability": 0.6708984375
                },
                {
                    "start": 1062.57,
                    "end": 1062.77,
                    "word": " the",
                    "probability": 0.77490234375
                },
                {
                    "start": 1062.77,
                    "end": 1063.03,
                    "word": " managed",
                    "probability": 0.291259765625
                },
                {
                    "start": 1063.03,
                    "end": 1063.33,
                    "word": " code",
                    "probability": 0.765625
                },
                {
                    "start": 1063.33,
                    "end": 1063.85,
                    "word": " contains",
                    "probability": 0.85986328125
                },
                {
                    "start": 1063.85,
                    "end": 1064.25,
                    "word": " only",
                    "probability": 0.85302734375
                },
                {
                    "start": 1064.25,
                    "end": 1064.63,
                    "word": " empty",
                    "probability": 0.60986328125
                },
                {
                    "start": 1064.63,
                    "end": 1064.97,
                    "word": " .NET",
                    "probability": 0.71533203125
                },
                {
                    "start": 1064.97,
                    "end": 1065.37,
                    "word": " class",
                    "probability": 0.82958984375
                },
                {
                    "start": 1065.37,
                    "end": 1065.79,
                    "word": ",",
                    "probability": 0.6455078125
                },
                {
                    "start": 1065.79,
                    "end": 1065.97,
                    "word": " while",
                    "probability": 0.8818359375
                },
                {
                    "start": 1065.97,
                    "end": 1066.15,
                    "word": " the",
                    "probability": 0.82568359375
                },
                {
                    "start": 1066.15,
                    "end": 1066.39,
                    "word": " native",
                    "probability": 0.63232421875
                },
                {
                    "start": 1066.39,
                    "end": 1066.73,
                    "word": " code",
                    "probability": 0.75830078125
                },
                {
                    "start": 1066.73,
                    "end": 1067.33,
                    "word": " contains",
                    "probability": 0.478515625
                },
                {
                    "start": 1068.55,
                    "end": 1068.89,
                    "word": " a dropper",
                    "probability": 0.74267578125
                },
                {
                    "start": 1068.89,
                    "end": 1069.17,
                    "word": " of",
                    "probability": 0.87451171875
                },
                {
                    "start": 1069.17,
                    "end": 1069.69,
                    "word": " unpacker",
                    "probability": 0.82373046875
                },
                {
                    "start": 1069.69,
                    "end": 1069.89,
                    "word": " batch",
                    "probability": 0.466552734375
                },
                {
                    "start": 1069.89,
                    "end": 1070.21,
                    "word": " file",
                    "probability": 0.7509765625
                },
                {
                    "start": 1070.21,
                    "end": 1070.51,
                    "word": " we",
                    "probability": 0.83251953125
                },
                {
                    "start": 1070.51,
                    "end": 1070.65,
                    "word": " saw",
                    "probability": 0.4921875
                },
                {
                    "start": 1070.65,
                    "end": 1071.05,
                    "word": " before",
                    "probability": 0.79296875
                },
                {
                    "start": 1071.05,
                    "end": 1071.67,
                    "word": ".",
                    "probability": 0.97998046875
                }
            ]
        },
        {
            "id": 194,
            "seek": 107790,
            "start": 1071.67,
            "end": 1077.47,
            "text": " But wait. Doesn't this nw.gold.dll file look familiar?",
            "tokens": [
                51014,
                583,
                1699,
                13,
                12955,
                380,
                341,
                297,
                86,
                13,
                1571,
                348,
                13,
                67,
                285,
                3991,
                574,
                4963,
                30,
                51314
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2534722354676988,
            "compression_ratio": 1.4587155963302751,
            "no_speech_prob": 0.1396484375,
            "words": [
                {
                    "start": 1071.67,
                    "end": 1071.87,
                    "word": " But",
                    "probability": 0.904296875
                },
                {
                    "start": 1071.87,
                    "end": 1072.25,
                    "word": " wait",
                    "probability": 0.814453125
                },
                {
                    "start": 1072.25,
                    "end": 1072.93,
                    "word": ".",
                    "probability": 0.15673828125
                },
                {
                    "start": 1073.01,
                    "end": 1073.47,
                    "word": " Doesn't",
                    "probability": 0.89306640625
                },
                {
                    "start": 1073.47,
                    "end": 1074.27,
                    "word": " this",
                    "probability": 0.350341796875
                },
                {
                    "start": 1074.27,
                    "end": 1074.91,
                    "word": " nw",
                    "probability": 0.795166015625
                },
                {
                    "start": 1074.91,
                    "end": 1075.43,
                    "word": ".gold",
                    "probability": 0.5767415364583334
                },
                {
                    "start": 1075.43,
                    "end": 1075.93,
                    "word": ".dll",
                    "probability": 0.82373046875
                },
                {
                    "start": 1075.93,
                    "end": 1076.39,
                    "word": " file",
                    "probability": 0.86376953125
                },
                {
                    "start": 1076.39,
                    "end": 1076.45,
                    "word": " look",
                    "probability": 0.73095703125
                },
                {
                    "start": 1076.45,
                    "end": 1076.79,
                    "word": " familiar",
                    "probability": 0.818359375
                },
                {
                    "start": 1076.79,
                    "end": 1077.47,
                    "word": "?",
                    "probability": 0.9892578125
                }
            ]
        },
        {
            "id": 195,
            "seek": 107790,
            "start": 1077.79,
            "end": 1083.41,
            "text": " Of course. We already saw the mixed-mod.dll with empty C-sharp class.",
            "tokens": [
                51314,
                2720,
                1164,
                13,
                492,
                1217,
                1866,
                264,
                7467,
                12,
                8014,
                13,
                67,
                285,
                365,
                6707,
                383,
                12,
                2716,
                6529,
                1508,
                13,
                51614
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2534722354676988,
            "compression_ratio": 1.4587155963302751,
            "no_speech_prob": 0.1396484375,
            "words": [
                {
                    "start": 1077.79,
                    "end": 1078.31,
                    "word": " Of",
                    "probability": 0.9091796875
                },
                {
                    "start": 1078.31,
                    "end": 1078.61,
                    "word": " course",
                    "probability": 0.8642578125
                },
                {
                    "start": 1078.61,
                    "end": 1079.21,
                    "word": ".",
                    "probability": 0.7578125
                },
                {
                    "start": 1079.21,
                    "end": 1079.35,
                    "word": " We",
                    "probability": 0.8818359375
                },
                {
                    "start": 1079.35,
                    "end": 1079.71,
                    "word": " already",
                    "probability": 0.77734375
                },
                {
                    "start": 1079.71,
                    "end": 1080.13,
                    "word": " saw",
                    "probability": 0.72998046875
                },
                {
                    "start": 1080.13,
                    "end": 1080.35,
                    "word": " the",
                    "probability": 0.798828125
                },
                {
                    "start": 1080.35,
                    "end": 1080.57,
                    "word": " mixed",
                    "probability": 0.385986328125
                },
                {
                    "start": 1080.57,
                    "end": 1080.85,
                    "word": "-mod",
                    "probability": 0.4234619140625
                },
                {
                    "start": 1080.85,
                    "end": 1081.27,
                    "word": ".dll",
                    "probability": 0.8473307291666666
                },
                {
                    "start": 1081.27,
                    "end": 1081.61,
                    "word": " with",
                    "probability": 0.779296875
                },
                {
                    "start": 1081.61,
                    "end": 1082.01,
                    "word": " empty",
                    "probability": 0.57080078125
                },
                {
                    "start": 1082.01,
                    "end": 1082.33,
                    "word": " C",
                    "probability": 0.955078125
                },
                {
                    "start": 1082.33,
                    "end": 1082.53,
                    "word": "-sharp",
                    "probability": 0.5189310709635416
                },
                {
                    "start": 1082.53,
                    "end": 1082.89,
                    "word": " class",
                    "probability": 0.8974609375
                },
                {
                    "start": 1082.89,
                    "end": 1083.41,
                    "word": ".",
                    "probability": 0.9921875
                }
            ]
        },
        {
            "id": 196,
            "seek": 110146,
            "start": 1083.41,
            "end": 1089.97,
            "text": " It was reverse shell payload delivered by the Telerik WebUI exploitation.",
            "tokens": [
                50364,
                467,
                390,
                9943,
                8720,
                30918,
                10144,
                538,
                264,
                314,
                6185,
                1035,
                9573,
                46324,
                33122,
                13,
                50714
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2900528152224044,
            "compression_ratio": 1.5245901639344261,
            "no_speech_prob": 0.3466796875,
            "words": [
                {
                    "start": 1083.41,
                    "end": 1083.63,
                    "word": " It",
                    "probability": 0.3203125
                },
                {
                    "start": 1083.63,
                    "end": 1084.03,
                    "word": " was",
                    "probability": 0.90283203125
                },
                {
                    "start": 1084.03,
                    "end": 1084.57,
                    "word": " reverse",
                    "probability": 0.3271484375
                },
                {
                    "start": 1084.57,
                    "end": 1084.87,
                    "word": " shell",
                    "probability": 0.7431640625
                },
                {
                    "start": 1084.87,
                    "end": 1085.25,
                    "word": " payload",
                    "probability": 0.84912109375
                },
                {
                    "start": 1085.25,
                    "end": 1085.83,
                    "word": " delivered",
                    "probability": 0.467529296875
                },
                {
                    "start": 1085.83,
                    "end": 1087.03,
                    "word": " by",
                    "probability": 0.8935546875
                },
                {
                    "start": 1087.03,
                    "end": 1087.27,
                    "word": " the",
                    "probability": 0.810546875
                },
                {
                    "start": 1087.27,
                    "end": 1087.69,
                    "word": " Telerik",
                    "probability": 0.8330078125
                },
                {
                    "start": 1087.69,
                    "end": 1088.65,
                    "word": " WebUI",
                    "probability": 0.5029296875
                },
                {
                    "start": 1088.65,
                    "end": 1089.21,
                    "word": " exploitation",
                    "probability": 0.65283203125
                },
                {
                    "start": 1089.21,
                    "end": 1089.97,
                    "word": ".",
                    "probability": 0.97900390625
                }
            ]
        },
        {
            "id": 197,
            "seek": 110146,
            "start": 1090.25,
            "end": 1093.97,
            "text": " So let's compare these two files side by side.",
            "tokens": [
                50714,
                407,
                718,
                311,
                6794,
                613,
                732,
                7098,
                1252,
                538,
                1252,
                13,
                50964
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2900528152224044,
            "compression_ratio": 1.5245901639344261,
            "no_speech_prob": 0.3466796875,
            "words": [
                {
                    "start": 1090.25,
                    "end": 1090.71,
                    "word": " So",
                    "probability": 0.81201171875
                },
                {
                    "start": 1090.71,
                    "end": 1091.37,
                    "word": " let's",
                    "probability": 0.758544921875
                },
                {
                    "start": 1091.37,
                    "end": 1091.75,
                    "word": " compare",
                    "probability": 0.87109375
                },
                {
                    "start": 1091.75,
                    "end": 1091.97,
                    "word": " these",
                    "probability": 0.708984375
                },
                {
                    "start": 1091.97,
                    "end": 1092.13,
                    "word": " two",
                    "probability": 0.83154296875
                },
                {
                    "start": 1092.13,
                    "end": 1092.43,
                    "word": " files",
                    "probability": 0.8193359375
                },
                {
                    "start": 1092.43,
                    "end": 1092.77,
                    "word": " side",
                    "probability": 0.78564453125
                },
                {
                    "start": 1092.77,
                    "end": 1092.91,
                    "word": " by",
                    "probability": 0.67333984375
                },
                {
                    "start": 1092.91,
                    "end": 1093.21,
                    "word": " side",
                    "probability": 0.81591796875
                },
                {
                    "start": 1093.21,
                    "end": 1093.97,
                    "word": ".",
                    "probability": 0.9931640625
                }
            ]
        },
        {
            "id": 198,
            "seek": 110146,
            "start": 1095.09,
            "end": 1099.07,
            "text": " We can see that they contain a lot of similarity stuff.",
            "tokens": [
                50964,
                492,
                393,
                536,
                300,
                436,
                5304,
                257,
                688,
                295,
                32194,
                1507,
                13,
                51114
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2900528152224044,
            "compression_ratio": 1.5245901639344261,
            "no_speech_prob": 0.3466796875,
            "words": [
                {
                    "start": 1095.09,
                    "end": 1095.85,
                    "word": " We",
                    "probability": 0.69873046875
                },
                {
                    "start": 1095.85,
                    "end": 1095.97,
                    "word": " can",
                    "probability": 0.90185546875
                },
                {
                    "start": 1095.97,
                    "end": 1096.19,
                    "word": " see",
                    "probability": 0.81787109375
                },
                {
                    "start": 1096.19,
                    "end": 1096.39,
                    "word": " that",
                    "probability": 0.87646484375
                },
                {
                    "start": 1096.39,
                    "end": 1096.63,
                    "word": " they",
                    "probability": 0.73779296875
                },
                {
                    "start": 1096.63,
                    "end": 1097.05,
                    "word": " contain",
                    "probability": 0.67822265625
                },
                {
                    "start": 1097.25,
                    "end": 1097.43,
                    "word": " a lot",
                    "probability": 0.8876953125
                },
                {
                    "start": 1097.43,
                    "end": 1097.61,
                    "word": " of",
                    "probability": 0.90380859375
                },
                {
                    "start": 1097.61,
                    "end": 1098.05,
                    "word": " similarity",
                    "probability": 0.7412109375
                },
                {
                    "start": 1098.05,
                    "end": 1098.49,
                    "word": " stuff",
                    "probability": 0.814453125
                },
                {
                    "start": 1098.49,
                    "end": 1099.07,
                    "word": ".",
                    "probability": 0.1993408203125
                }
            ]
        },
        {
            "id": 199,
            "seek": 110146,
            "start": 1099.07,
            "end": 1106.97,
            "text": " And we could assume that this dll had been also created with build scripts from Telerik WebUI exploit.",
            "tokens": [
                51114,
                400,
                321,
                727,
                6552,
                300,
                341,
                274,
                285,
                632,
                668,
                611,
                2942,
                365,
                1322,
                23294,
                490,
                314,
                6185,
                1035,
                9573,
                46324,
                25924,
                13,
                51514
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2900528152224044,
            "compression_ratio": 1.5245901639344261,
            "no_speech_prob": 0.3466796875,
            "words": [
                {
                    "start": 1099.07,
                    "end": 1099.25,
                    "word": " And",
                    "probability": 0.87158203125
                },
                {
                    "start": 1099.25,
                    "end": 1099.49,
                    "word": " we",
                    "probability": 0.9013671875
                },
                {
                    "start": 1099.49,
                    "end": 1099.71,
                    "word": " could",
                    "probability": 0.80419921875
                },
                {
                    "start": 1099.71,
                    "end": 1100.33,
                    "word": " assume",
                    "probability": 0.802734375
                },
                {
                    "start": 1100.33,
                    "end": 1101.41,
                    "word": " that",
                    "probability": 0.87353515625
                },
                {
                    "start": 1101.41,
                    "end": 1101.97,
                    "word": " this",
                    "probability": 0.7998046875
                },
                {
                    "start": 1101.97,
                    "end": 1102.25,
                    "word": " dll",
                    "probability": 0.4874420166015625
                },
                {
                    "start": 1102.25,
                    "end": 1102.61,
                    "word": " had",
                    "probability": 0.7314453125
                },
                {
                    "start": 1102.61,
                    "end": 1102.83,
                    "word": " been",
                    "probability": 0.7734375
                },
                {
                    "start": 1102.83,
                    "end": 1103.15,
                    "word": " also",
                    "probability": 0.84130859375
                },
                {
                    "start": 1103.15,
                    "end": 1103.67,
                    "word": " created",
                    "probability": 0.7314453125
                },
                {
                    "start": 1103.67,
                    "end": 1104.19,
                    "word": " with",
                    "probability": 0.76318359375
                },
                {
                    "start": 1104.19,
                    "end": 1104.43,
                    "word": " build",
                    "probability": 0.66064453125
                },
                {
                    "start": 1104.43,
                    "end": 1104.77,
                    "word": " scripts",
                    "probability": 0.6962890625
                },
                {
                    "start": 1104.77,
                    "end": 1105.15,
                    "word": " from",
                    "probability": 0.8251953125
                },
                {
                    "start": 1105.15,
                    "end": 1105.55,
                    "word": " Telerik",
                    "probability": 0.90283203125
                },
                {
                    "start": 1105.55,
                    "end": 1106.03,
                    "word": " WebUI",
                    "probability": 0.8251953125
                },
                {
                    "start": 1106.03,
                    "end": 1106.61,
                    "word": " exploit",
                    "probability": 0.68994140625
                },
                {
                    "start": 1106.61,
                    "end": 1106.97,
                    "word": ".",
                    "probability": 0.489501953125
                }
            ]
        },
        {
            "id": 200,
            "seek": 112786,
            "start": 1106.97,
            "end": 1110.75,
            "text": " But now, it was developed by TreadActor.",
            "tokens": [
                50364,
                583,
                586,
                11,
                309,
                390,
                4743,
                538,
                314,
                2538,
                32,
                1672,
                13,
                50514
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24888392431395395,
            "compression_ratio": 1.4973262032085561,
            "no_speech_prob": 0.2139892578125,
            "words": [
                {
                    "start": 1106.97,
                    "end": 1107.21,
                    "word": " But",
                    "probability": 0.369384765625
                },
                {
                    "start": 1107.21,
                    "end": 1107.57,
                    "word": " now",
                    "probability": 0.85986328125
                },
                {
                    "start": 1107.57,
                    "end": 1108.17,
                    "word": ",",
                    "probability": 0.52490234375
                },
                {
                    "start": 1108.17,
                    "end": 1108.39,
                    "word": " it",
                    "probability": 0.89453125
                },
                {
                    "start": 1108.39,
                    "end": 1108.65,
                    "word": " was",
                    "probability": 0.8994140625
                },
                {
                    "start": 1108.65,
                    "end": 1109.11,
                    "word": " developed",
                    "probability": 0.6650390625
                },
                {
                    "start": 1109.11,
                    "end": 1109.47,
                    "word": " by",
                    "probability": 0.91357421875
                },
                {
                    "start": 1109.47,
                    "end": 1110.03,
                    "word": " TreadActor",
                    "probability": 0.64752197265625
                },
                {
                    "start": 1110.03,
                    "end": 1110.75,
                    "word": ".",
                    "probability": 0.9697265625
                }
            ]
        },
        {
            "id": 201,
            "seek": 112786,
            "start": 1113.13,
            "end": 1117.33,
            "text": " Okay. We found all missing pieces of puzzle.",
            "tokens": [
                50664,
                1033,
                13,
                492,
                1352,
                439,
                5361,
                3755,
                295,
                12805,
                13,
                50864
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24888392431395395,
            "compression_ratio": 1.4973262032085561,
            "no_speech_prob": 0.2139892578125,
            "words": [
                {
                    "start": 1113.13,
                    "end": 1113.85,
                    "word": " Okay",
                    "probability": 0.489990234375
                },
                {
                    "start": 1113.85,
                    "end": 1114.57,
                    "word": ".",
                    "probability": 0.333251953125
                },
                {
                    "start": 1114.57,
                    "end": 1114.75,
                    "word": " We",
                    "probability": 0.90283203125
                },
                {
                    "start": 1114.75,
                    "end": 1115.11,
                    "word": " found",
                    "probability": 0.87939453125
                },
                {
                    "start": 1115.11,
                    "end": 1115.45,
                    "word": " all",
                    "probability": 0.86572265625
                },
                {
                    "start": 1115.45,
                    "end": 1115.75,
                    "word": " missing",
                    "probability": 0.82275390625
                },
                {
                    "start": 1115.75,
                    "end": 1116.05,
                    "word": " pieces",
                    "probability": 0.90185546875
                },
                {
                    "start": 1116.05,
                    "end": 1116.29,
                    "word": " of",
                    "probability": 0.9052734375
                },
                {
                    "start": 1116.29,
                    "end": 1116.61,
                    "word": " puzzle",
                    "probability": 0.521484375
                },
                {
                    "start": 1116.61,
                    "end": 1117.33,
                    "word": ".",
                    "probability": 0.95947265625
                }
            ]
        },
        {
            "id": 202,
            "seek": 112786,
            "start": 1117.33,
            "end": 1122.77,
            "text": " We also collected all samples needed for attack reconstruction or simulation.",
            "tokens": [
                50864,
                492,
                611,
                11087,
                439,
                10938,
                2978,
                337,
                2690,
                31565,
                420,
                16575,
                13,
                51114
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24888392431395395,
            "compression_ratio": 1.4973262032085561,
            "no_speech_prob": 0.2139892578125,
            "words": [
                {
                    "start": 1117.33,
                    "end": 1117.47,
                    "word": " We",
                    "probability": 0.90576171875
                },
                {
                    "start": 1117.47,
                    "end": 1117.77,
                    "word": " also",
                    "probability": 0.8203125
                },
                {
                    "start": 1117.77,
                    "end": 1118.23,
                    "word": " collected",
                    "probability": 0.58984375
                },
                {
                    "start": 1118.23,
                    "end": 1118.63,
                    "word": " all",
                    "probability": 0.89453125
                },
                {
                    "start": 1118.63,
                    "end": 1119.13,
                    "word": " samples",
                    "probability": 0.75390625
                },
                {
                    "start": 1119.13,
                    "end": 1119.45,
                    "word": " needed",
                    "probability": 0.70703125
                },
                {
                    "start": 1119.45,
                    "end": 1119.83,
                    "word": " for",
                    "probability": 0.89599609375
                },
                {
                    "start": 1119.83,
                    "end": 1120.15,
                    "word": " attack",
                    "probability": 0.69091796875
                },
                {
                    "start": 1120.15,
                    "end": 1120.77,
                    "word": " reconstruction",
                    "probability": 0.77294921875
                },
                {
                    "start": 1120.77,
                    "end": 1121.63,
                    "word": " or",
                    "probability": 0.75244140625
                },
                {
                    "start": 1121.63,
                    "end": 1122.15,
                    "word": " simulation",
                    "probability": 0.90673828125
                },
                {
                    "start": 1122.15,
                    "end": 1122.77,
                    "word": ".",
                    "probability": 0.84326171875
                }
            ]
        },
        {
            "id": 203,
            "seek": 112786,
            "start": 1122.77,
            "end": 1126.25,
            "text": " And in that moment, we went one step further.",
            "tokens": [
                51114,
                400,
                294,
                300,
                1623,
                11,
                321,
                1437,
                472,
                1823,
                3052,
                13,
                51314
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24888392431395395,
            "compression_ratio": 1.4973262032085561,
            "no_speech_prob": 0.2139892578125,
            "words": [
                {
                    "start": 1122.77,
                    "end": 1122.91,
                    "word": " And",
                    "probability": 0.8173828125
                },
                {
                    "start": 1122.91,
                    "end": 1123.09,
                    "word": " in",
                    "probability": 0.8701171875
                },
                {
                    "start": 1123.09,
                    "end": 1123.23,
                    "word": " that",
                    "probability": 0.8603515625
                },
                {
                    "start": 1123.23,
                    "end": 1123.63,
                    "word": " moment",
                    "probability": 0.90185546875
                },
                {
                    "start": 1123.63,
                    "end": 1124.39,
                    "word": ",",
                    "probability": 0.91943359375
                },
                {
                    "start": 1124.39,
                    "end": 1124.53,
                    "word": " we",
                    "probability": 0.8759765625
                },
                {
                    "start": 1124.53,
                    "end": 1124.81,
                    "word": " went",
                    "probability": 0.80126953125
                },
                {
                    "start": 1124.81,
                    "end": 1125.21,
                    "word": " one",
                    "probability": 0.80908203125
                },
                {
                    "start": 1125.21,
                    "end": 1125.37,
                    "word": " step",
                    "probability": 0.8251953125
                },
                {
                    "start": 1125.37,
                    "end": 1125.75,
                    "word": " further",
                    "probability": 0.8525390625
                },
                {
                    "start": 1125.75,
                    "end": 1126.25,
                    "word": ".",
                    "probability": 0.7529296875
                }
            ]
        },
        {
            "id": 204,
            "seek": 112786,
            "start": 1126.25,
            "end": 1133.37,
            "text": " We also collected the whole set of needed samples from public sources.",
            "tokens": [
                51314,
                492,
                611,
                11087,
                264,
                1379,
                992,
                295,
                2978,
                10938,
                490,
                1908,
                7139,
                13,
                51664
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24888392431395395,
            "compression_ratio": 1.4973262032085561,
            "no_speech_prob": 0.2139892578125,
            "words": [
                {
                    "start": 1126.25,
                    "end": 1126.35,
                    "word": " We",
                    "probability": 0.78662109375
                },
                {
                    "start": 1126.35,
                    "end": 1126.67,
                    "word": " also",
                    "probability": 0.79931640625
                },
                {
                    "start": 1126.67,
                    "end": 1128.27,
                    "word": " collected",
                    "probability": 0.65087890625
                },
                {
                    "start": 1128.27,
                    "end": 1129.07,
                    "word": " the",
                    "probability": 0.77685546875
                },
                {
                    "start": 1129.07,
                    "end": 1129.33,
                    "word": " whole",
                    "probability": 0.755859375
                },
                {
                    "start": 1129.33,
                    "end": 1129.67,
                    "word": " set",
                    "probability": 0.89453125
                },
                {
                    "start": 1129.67,
                    "end": 1130.97,
                    "word": " of",
                    "probability": 0.89306640625
                },
                {
                    "start": 1130.97,
                    "end": 1131.25,
                    "word": " needed",
                    "probability": 0.6787109375
                },
                {
                    "start": 1131.25,
                    "end": 1131.69,
                    "word": " samples",
                    "probability": 0.7763671875
                },
                {
                    "start": 1131.69,
                    "end": 1131.95,
                    "word": " from",
                    "probability": 0.82177734375
                },
                {
                    "start": 1131.95,
                    "end": 1132.29,
                    "word": " public",
                    "probability": 0.85107421875
                },
                {
                    "start": 1132.29,
                    "end": 1132.65,
                    "word": " sources",
                    "probability": 0.73876953125
                },
                {
                    "start": 1132.65,
                    "end": 1133.37,
                    "word": ".",
                    "probability": 0.98193359375
                }
            ]
        },
        {
            "id": 205,
            "seek": 115626,
            "start": 1133.37,
            "end": 1144.65,
            "text": " Therefore, we could demonstrate this attack using public sandboxes without revealing any sensitive info from the private samples shared by our client.",
            "tokens": [
                50364,
                7504,
                11,
                321,
                727,
                11698,
                341,
                2690,
                1228,
                1908,
                42115,
                279,
                1553,
                23983,
                604,
                9477,
                13614,
                490,
                264,
                4551,
                10938,
                5507,
                538,
                527,
                6423,
                13,
                50914
            ],
            "temperature": 0.0,
            "avg_logprob": -0.19959076901986486,
            "compression_ratio": 1.5474137931034482,
            "no_speech_prob": 0.0159454345703125,
            "words": [
                {
                    "start": 1133.37,
                    "end": 1133.91,
                    "word": " Therefore",
                    "probability": 0.6015625
                },
                {
                    "start": 1133.91,
                    "end": 1134.35,
                    "word": ",",
                    "probability": 0.85888671875
                },
                {
                    "start": 1134.35,
                    "end": 1134.53,
                    "word": " we",
                    "probability": 0.8955078125
                },
                {
                    "start": 1134.53,
                    "end": 1134.67,
                    "word": " could",
                    "probability": 0.83935546875
                },
                {
                    "start": 1134.67,
                    "end": 1135.21,
                    "word": " demonstrate",
                    "probability": 0.8271484375
                },
                {
                    "start": 1135.21,
                    "end": 1135.59,
                    "word": " this",
                    "probability": 0.826171875
                },
                {
                    "start": 1135.59,
                    "end": 1135.95,
                    "word": " attack",
                    "probability": 0.82421875
                },
                {
                    "start": 1135.95,
                    "end": 1136.33,
                    "word": " using",
                    "probability": 0.83447265625
                },
                {
                    "start": 1136.33,
                    "end": 1136.73,
                    "word": " public",
                    "probability": 0.78173828125
                },
                {
                    "start": 1136.73,
                    "end": 1138.31,
                    "word": " sandboxes",
                    "probability": 0.850830078125
                },
                {
                    "start": 1138.31,
                    "end": 1139.05,
                    "word": " without",
                    "probability": 0.6953125
                },
                {
                    "start": 1139.05,
                    "end": 1139.69,
                    "word": " revealing",
                    "probability": 0.90966796875
                },
                {
                    "start": 1139.69,
                    "end": 1140.13,
                    "word": " any",
                    "probability": 0.84326171875
                },
                {
                    "start": 1140.13,
                    "end": 1140.53,
                    "word": " sensitive",
                    "probability": 0.7880859375
                },
                {
                    "start": 1140.53,
                    "end": 1140.87,
                    "word": " info",
                    "probability": 0.6298828125
                },
                {
                    "start": 1140.87,
                    "end": 1141.29,
                    "word": " from",
                    "probability": 0.81982421875
                },
                {
                    "start": 1141.29,
                    "end": 1141.81,
                    "word": " the",
                    "probability": 0.77001953125
                },
                {
                    "start": 1141.81,
                    "end": 1142.47,
                    "word": " private",
                    "probability": 0.638671875
                },
                {
                    "start": 1142.47,
                    "end": 1142.99,
                    "word": " samples",
                    "probability": 0.70947265625
                },
                {
                    "start": 1142.99,
                    "end": 1143.39,
                    "word": " shared",
                    "probability": 0.75927734375
                },
                {
                    "start": 1143.39,
                    "end": 1143.63,
                    "word": " by",
                    "probability": 0.9091796875
                },
                {
                    "start": 1143.63,
                    "end": 1143.93,
                    "word": " our",
                    "probability": 0.8046875
                },
                {
                    "start": 1143.93,
                    "end": 1144.33,
                    "word": " client",
                    "probability": 0.84228515625
                },
                {
                    "start": 1144.33,
                    "end": 1144.65,
                    "word": ".",
                    "probability": 0.95654296875
                }
            ]
        },
        {
            "id": 206,
            "seek": 115626,
            "start": 1145.03,
            "end": 1148.63,
            "text": " So, let's allow me to play a short video demonstration.",
            "tokens": [
                50914,
                407,
                11,
                718,
                311,
                2089,
                385,
                281,
                862,
                257,
                2099,
                960,
                16520,
                13,
                51114
            ],
            "temperature": 0.0,
            "avg_logprob": -0.19959076901986486,
            "compression_ratio": 1.5474137931034482,
            "no_speech_prob": 0.0159454345703125,
            "words": [
                {
                    "start": 1145.03,
                    "end": 1145.39,
                    "word": " So",
                    "probability": 0.8212890625
                },
                {
                    "start": 1145.39,
                    "end": 1145.63,
                    "word": ",",
                    "probability": 0.6962890625
                },
                {
                    "start": 1145.63,
                    "end": 1145.95,
                    "word": " let's",
                    "probability": 0.916259765625
                },
                {
                    "start": 1145.95,
                    "end": 1146.17,
                    "word": " allow",
                    "probability": 0.9072265625
                },
                {
                    "start": 1146.17,
                    "end": 1146.39,
                    "word": " me",
                    "probability": 0.912109375
                },
                {
                    "start": 1146.39,
                    "end": 1146.59,
                    "word": " to",
                    "probability": 0.90380859375
                },
                {
                    "start": 1146.59,
                    "end": 1146.87,
                    "word": " play",
                    "probability": 0.8701171875
                },
                {
                    "start": 1147.09,
                    "end": 1147.39,
                    "word": " a short",
                    "probability": 0.91748046875
                },
                {
                    "start": 1147.39,
                    "end": 1147.69,
                    "word": " video",
                    "probability": 0.7705078125
                },
                {
                    "start": 1147.69,
                    "end": 1148.31,
                    "word": " demonstration",
                    "probability": 0.826171875
                },
                {
                    "start": 1148.31,
                    "end": 1148.63,
                    "word": ".",
                    "probability": 0.9326171875
                }
            ]
        },
        {
            "id": 207,
            "seek": 115626,
            "start": 1288.73,
            "end": 1291.29,
            "text": " Okay. Thank you for watching the video.",
            "tokens": [
                51314,
                1033,
                13,
                1044,
                291,
                337,
                1976,
                264,
                960,
                13,
                51414
            ],
            "temperature": 0.0,
            "avg_logprob": -0.19959076901986486,
            "compression_ratio": 1.5474137931034482,
            "no_speech_prob": 0.0159454345703125,
            "words": [
                {
                    "start": 1288.73,
                    "end": 1289.37,
                    "word": " Okay",
                    "probability": 0.388671875
                },
                {
                    "start": 1289.37,
                    "end": 1289.69,
                    "word": ".",
                    "probability": 0.147216796875
                },
                {
                    "start": 1289.69,
                    "end": 1289.93,
                    "word": " Thank",
                    "probability": 0.8681640625
                },
                {
                    "start": 1289.93,
                    "end": 1290.05,
                    "word": " you",
                    "probability": 0.89599609375
                },
                {
                    "start": 1290.05,
                    "end": 1290.21,
                    "word": " for",
                    "probability": 0.8955078125
                },
                {
                    "start": 1290.21,
                    "end": 1290.47,
                    "word": " watching",
                    "probability": 0.734375
                },
                {
                    "start": 1290.47,
                    "end": 1290.63,
                    "word": " the",
                    "probability": 0.8056640625
                },
                {
                    "start": 1290.63,
                    "end": 1290.89,
                    "word": " video",
                    "probability": 0.79296875
                },
                {
                    "start": 1290.89,
                    "end": 1291.29,
                    "word": ".",
                    "probability": 0.6630859375
                }
            ]
        },
        {
            "id": 208,
            "seek": 115626,
            "start": 1291.29,
            "end": 1296.31,
            "text": " And now, before we summarize our findings, let's proceed with the last part of this talk.",
            "tokens": [
                51414,
                400,
                586,
                11,
                949,
                321,
                20858,
                527,
                16483,
                11,
                718,
                311,
                8991,
                365,
                264,
                1036,
                644,
                295,
                341,
                751,
                13,
                51664
            ],
            "temperature": 0.0,
            "avg_logprob": -0.19959076901986486,
            "compression_ratio": 1.5474137931034482,
            "no_speech_prob": 0.0159454345703125,
            "words": [
                {
                    "start": 1291.29,
                    "end": 1291.43,
                    "word": " And",
                    "probability": 0.794921875
                },
                {
                    "start": 1291.43,
                    "end": 1291.71,
                    "word": " now",
                    "probability": 0.875
                },
                {
                    "start": 1291.71,
                    "end": 1291.83,
                    "word": ",",
                    "probability": 0.80224609375
                },
                {
                    "start": 1291.83,
                    "end": 1292.07,
                    "word": " before",
                    "probability": 0.79296875
                },
                {
                    "start": 1292.07,
                    "end": 1292.25,
                    "word": " we",
                    "probability": 0.89208984375
                },
                {
                    "start": 1292.25,
                    "end": 1292.51,
                    "word": " summarize",
                    "probability": 0.60693359375
                },
                {
                    "start": 1292.51,
                    "end": 1292.99,
                    "word": " our",
                    "probability": 0.8203125
                },
                {
                    "start": 1292.99,
                    "end": 1293.43,
                    "word": " findings",
                    "probability": 0.8115234375
                },
                {
                    "start": 1293.43,
                    "end": 1293.81,
                    "word": ",",
                    "probability": 0.94677734375
                },
                {
                    "start": 1293.81,
                    "end": 1294.03,
                    "word": " let's",
                    "probability": 0.939453125
                },
                {
                    "start": 1294.03,
                    "end": 1294.35,
                    "word": " proceed",
                    "probability": 0.87158203125
                },
                {
                    "start": 1294.35,
                    "end": 1294.59,
                    "word": " with",
                    "probability": 0.78857421875
                },
                {
                    "start": 1294.59,
                    "end": 1294.79,
                    "word": " the",
                    "probability": 0.81689453125
                },
                {
                    "start": 1294.79,
                    "end": 1294.97,
                    "word": " last",
                    "probability": 0.83740234375
                },
                {
                    "start": 1294.97,
                    "end": 1295.23,
                    "word": " part",
                    "probability": 0.8310546875
                },
                {
                    "start": 1295.23,
                    "end": 1295.37,
                    "word": " of",
                    "probability": 0.90625
                },
                {
                    "start": 1295.37,
                    "end": 1295.53,
                    "word": " this",
                    "probability": 0.8779296875
                },
                {
                    "start": 1295.53,
                    "end": 1295.85,
                    "word": " talk",
                    "probability": 0.791015625
                },
                {
                    "start": 1295.85,
                    "end": 1296.31,
                    "word": ".",
                    "probability": 0.21630859375
                }
            ]
        },
        {
            "id": 209,
            "seek": 115626,
            "start": 1296.31,
            "end": 1297.85,
            "text": " The attacker's profit.",
            "tokens": [
                51664,
                440,
                35871,
                311,
                7475,
                13,
                51764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.19959076901986486,
            "compression_ratio": 1.5474137931034482,
            "no_speech_prob": 0.0159454345703125,
            "words": [
                {
                    "start": 1296.31,
                    "end": 1296.49,
                    "word": " The",
                    "probability": 0.78076171875
                },
                {
                    "start": 1296.49,
                    "end": 1296.99,
                    "word": " attacker's",
                    "probability": 0.7039794921875
                },
                {
                    "start": 1296.99,
                    "end": 1297.21,
                    "word": " profit",
                    "probability": 0.72021484375
                },
                {
                    "start": 1297.21,
                    "end": 1297.85,
                    "word": ".",
                    "probability": 0.9765625
                }
            ]
        },
        {
            "id": 210,
            "seek": 118012,
            "start": 1297.85,
            "end": 1306.01,
            "text": " We extracted crypto mining pool's parameters and configuration either from captured pickups or from memory dumps.",
            "tokens": [
                50364,
                492,
                34086,
                17240,
                15512,
                7005,
                311,
                9834,
                293,
                11694,
                2139,
                490,
                11828,
                1888,
                7528,
                420,
                490,
                4675,
                11430,
                82,
                13,
                50764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.23273026178541936,
            "compression_ratio": 1.6103286384976525,
            "no_speech_prob": 0.09747314453125,
            "words": [
                {
                    "start": 1297.85,
                    "end": 1298.19,
                    "word": " We",
                    "probability": 0.77490234375
                },
                {
                    "start": 1298.19,
                    "end": 1298.55,
                    "word": " extracted",
                    "probability": 0.630859375
                },
                {
                    "start": 1298.55,
                    "end": 1298.97,
                    "word": " crypto",
                    "probability": 0.4228515625
                },
                {
                    "start": 1298.97,
                    "end": 1299.27,
                    "word": " mining",
                    "probability": 0.85791015625
                },
                {
                    "start": 1299.27,
                    "end": 1299.77,
                    "word": " pool's",
                    "probability": 0.640380859375
                },
                {
                    "start": 1299.77,
                    "end": 1300.29,
                    "word": " parameters",
                    "probability": 0.890625
                },
                {
                    "start": 1300.29,
                    "end": 1300.85,
                    "word": " and",
                    "probability": 0.86669921875
                },
                {
                    "start": 1300.85,
                    "end": 1301.45,
                    "word": " configuration",
                    "probability": 0.74169921875
                },
                {
                    "start": 1301.45,
                    "end": 1302.39,
                    "word": " either",
                    "probability": 0.5556640625
                },
                {
                    "start": 1302.39,
                    "end": 1302.79,
                    "word": " from",
                    "probability": 0.81640625
                },
                {
                    "start": 1302.79,
                    "end": 1303.29,
                    "word": " captured",
                    "probability": 0.658203125
                },
                {
                    "start": 1303.29,
                    "end": 1303.91,
                    "word": " pickups",
                    "probability": 0.5531005859375
                },
                {
                    "start": 1303.91,
                    "end": 1304.23,
                    "word": " or",
                    "probability": 0.87060546875
                },
                {
                    "start": 1304.23,
                    "end": 1304.51,
                    "word": " from",
                    "probability": 0.8115234375
                },
                {
                    "start": 1304.51,
                    "end": 1304.97,
                    "word": " memory",
                    "probability": 0.77978515625
                },
                {
                    "start": 1304.97,
                    "end": 1305.77,
                    "word": " dumps",
                    "probability": 0.881103515625
                },
                {
                    "start": 1305.77,
                    "end": 1306.01,
                    "word": ".",
                    "probability": 0.931640625
                }
            ]
        },
        {
            "id": 211,
            "seek": 118012,
            "start": 1306.01,
            "end": 1312.63,
            "text": " Then, we used these parameters for hunting for more and more samples and repeated this process again and again.",
            "tokens": [
                50764,
                1396,
                11,
                321,
                1143,
                613,
                9834,
                337,
                12599,
                337,
                544,
                293,
                544,
                10938,
                293,
                10477,
                341,
                1399,
                797,
                293,
                797,
                13,
                51114
            ],
            "temperature": 0.0,
            "avg_logprob": -0.23273026178541936,
            "compression_ratio": 1.6103286384976525,
            "no_speech_prob": 0.09747314453125,
            "words": [
                {
                    "start": 1306.01,
                    "end": 1306.25,
                    "word": " Then",
                    "probability": 0.77783203125
                },
                {
                    "start": 1306.25,
                    "end": 1306.67,
                    "word": ",",
                    "probability": 0.46826171875
                },
                {
                    "start": 1306.67,
                    "end": 1306.83,
                    "word": " we",
                    "probability": 0.89453125
                },
                {
                    "start": 1306.83,
                    "end": 1306.99,
                    "word": " used",
                    "probability": 0.72314453125
                },
                {
                    "start": 1306.99,
                    "end": 1307.15,
                    "word": " these",
                    "probability": 0.693359375
                },
                {
                    "start": 1307.15,
                    "end": 1307.57,
                    "word": " parameters",
                    "probability": 0.884765625
                },
                {
                    "start": 1307.57,
                    "end": 1307.91,
                    "word": " for",
                    "probability": 0.89697265625
                },
                {
                    "start": 1307.91,
                    "end": 1308.21,
                    "word": " hunting",
                    "probability": 0.751953125
                },
                {
                    "start": 1308.21,
                    "end": 1308.61,
                    "word": " for",
                    "probability": 0.884765625
                },
                {
                    "start": 1308.61,
                    "end": 1308.85,
                    "word": " more",
                    "probability": 0.888671875
                },
                {
                    "start": 1308.85,
                    "end": 1309.03,
                    "word": " and",
                    "probability": 0.89013671875
                },
                {
                    "start": 1309.03,
                    "end": 1309.25,
                    "word": " more",
                    "probability": 0.8857421875
                },
                {
                    "start": 1309.25,
                    "end": 1309.67,
                    "word": " samples",
                    "probability": 0.77783203125
                },
                {
                    "start": 1309.67,
                    "end": 1310.17,
                    "word": " and",
                    "probability": 0.615234375
                },
                {
                    "start": 1310.17,
                    "end": 1310.55,
                    "word": " repeated",
                    "probability": 0.82275390625
                },
                {
                    "start": 1310.55,
                    "end": 1310.81,
                    "word": " this",
                    "probability": 0.86376953125
                },
                {
                    "start": 1310.81,
                    "end": 1311.19,
                    "word": " process",
                    "probability": 0.8642578125
                },
                {
                    "start": 1311.19,
                    "end": 1311.55,
                    "word": " again",
                    "probability": 0.908203125
                },
                {
                    "start": 1311.55,
                    "end": 1311.71,
                    "word": " and",
                    "probability": 0.88720703125
                },
                {
                    "start": 1311.71,
                    "end": 1312.03,
                    "word": " again",
                    "probability": 0.9228515625
                },
                {
                    "start": 1312.03,
                    "end": 1312.63,
                    "word": ".",
                    "probability": 0.98779296875
                }
            ]
        },
        {
            "id": 212,
            "seek": 118012,
            "start": 1312.63,
            "end": 1317.85,
            "text": " Finally, we collected several workers' IDs, but only two account IDs.",
            "tokens": [
                51114,
                6288,
                11,
                321,
                11087,
                2940,
                5600,
                6,
                48212,
                11,
                457,
                787,
                732,
                2696,
                48212,
                13,
                51364
            ],
            "temperature": 0.0,
            "avg_logprob": -0.23273026178541936,
            "compression_ratio": 1.6103286384976525,
            "no_speech_prob": 0.09747314453125,
            "words": [
                {
                    "start": 1312.63,
                    "end": 1313.07,
                    "word": " Finally",
                    "probability": 0.70458984375
                },
                {
                    "start": 1313.07,
                    "end": 1313.37,
                    "word": ",",
                    "probability": 0.96142578125
                },
                {
                    "start": 1313.37,
                    "end": 1313.59,
                    "word": " we",
                    "probability": 0.90234375
                },
                {
                    "start": 1313.59,
                    "end": 1313.89,
                    "word": " collected",
                    "probability": 0.6650390625
                },
                {
                    "start": 1313.89,
                    "end": 1314.33,
                    "word": " several",
                    "probability": 0.84033203125
                },
                {
                    "start": 1314.33,
                    "end": 1314.73,
                    "word": " workers",
                    "probability": 0.5556640625
                },
                {
                    "start": 1314.73,
                    "end": 1315.01,
                    "word": "'",
                    "probability": 0.634765625
                },
                {
                    "start": 1315.01,
                    "end": 1315.21,
                    "word": " IDs",
                    "probability": 0.7890625
                },
                {
                    "start": 1315.21,
                    "end": 1315.79,
                    "word": ",",
                    "probability": 0.54345703125
                },
                {
                    "start": 1315.79,
                    "end": 1315.91,
                    "word": " but",
                    "probability": 0.89697265625
                },
                {
                    "start": 1315.91,
                    "end": 1316.15,
                    "word": " only",
                    "probability": 0.8447265625
                },
                {
                    "start": 1316.15,
                    "end": 1316.43,
                    "word": " two",
                    "probability": 0.70849609375
                },
                {
                    "start": 1316.43,
                    "end": 1316.83,
                    "word": " account",
                    "probability": 0.7509765625
                },
                {
                    "start": 1316.83,
                    "end": 1317.29,
                    "word": " IDs",
                    "probability": 0.88818359375
                },
                {
                    "start": 1317.29,
                    "end": 1317.85,
                    "word": ".",
                    "probability": 0.97900390625
                }
            ]
        },
        {
            "id": 213,
            "seek": 118012,
            "start": 1317.85,
            "end": 1321.71,
            "text": " These account IDs were reused in several cases.",
            "tokens": [
                51364,
                1981,
                2696,
                48212,
                645,
                319,
                4717,
                294,
                2940,
                3331,
                13,
                51564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.23273026178541936,
            "compression_ratio": 1.6103286384976525,
            "no_speech_prob": 0.09747314453125,
            "words": [
                {
                    "start": 1317.85,
                    "end": 1318.13,
                    "word": " These",
                    "probability": 0.908203125
                },
                {
                    "start": 1318.13,
                    "end": 1318.49,
                    "word": " account",
                    "probability": 0.8095703125
                },
                {
                    "start": 1318.49,
                    "end": 1318.93,
                    "word": " IDs",
                    "probability": 0.8173828125
                },
                {
                    "start": 1318.93,
                    "end": 1319.65,
                    "word": " were",
                    "probability": 0.8837890625
                },
                {
                    "start": 1319.65,
                    "end": 1320.07,
                    "word": " reused",
                    "probability": 0.863037109375
                },
                {
                    "start": 1320.07,
                    "end": 1320.31,
                    "word": " in",
                    "probability": 0.9052734375
                },
                {
                    "start": 1320.31,
                    "end": 1320.61,
                    "word": " several",
                    "probability": 0.83642578125
                },
                {
                    "start": 1320.61,
                    "end": 1321.07,
                    "word": " cases",
                    "probability": 0.7939453125
                },
                {
                    "start": 1321.07,
                    "end": 1321.71,
                    "word": ".",
                    "probability": 0.98583984375
                }
            ]
        },
        {
            "id": 214,
            "seek": 120760,
            "start": 1321.71,
            "end": 1328.93,
            "text": " In the table, there are amounts of monero coin mines mined by attackers on various pools.",
            "tokens": [
                50364,
                682,
                264,
                3199,
                11,
                456,
                366,
                11663,
                295,
                1108,
                2032,
                11464,
                25398,
                923,
                292,
                538,
                45129,
                322,
                3683,
                28688,
                13,
                50714
            ],
            "temperature": 0.0,
            "avg_logprob": -0.23092532622349726,
            "compression_ratio": 1.538860103626943,
            "no_speech_prob": 0.1290283203125,
            "words": [
                {
                    "start": 1321.71,
                    "end": 1321.95,
                    "word": " In",
                    "probability": 0.78125
                },
                {
                    "start": 1321.95,
                    "end": 1322.09,
                    "word": " the",
                    "probability": 0.80419921875
                },
                {
                    "start": 1322.09,
                    "end": 1322.45,
                    "word": " table",
                    "probability": 0.8203125
                },
                {
                    "start": 1322.45,
                    "end": 1322.83,
                    "word": ",",
                    "probability": 0.462158203125
                },
                {
                    "start": 1322.83,
                    "end": 1323.09,
                    "word": " there",
                    "probability": 0.86962890625
                },
                {
                    "start": 1323.09,
                    "end": 1323.35,
                    "word": " are",
                    "probability": 0.884765625
                },
                {
                    "start": 1323.35,
                    "end": 1323.81,
                    "word": " amounts",
                    "probability": 0.72265625
                },
                {
                    "start": 1323.81,
                    "end": 1324.13,
                    "word": " of",
                    "probability": 0.9033203125
                },
                {
                    "start": 1324.13,
                    "end": 1324.43,
                    "word": " monero",
                    "probability": 0.5823974609375
                },
                {
                    "start": 1324.43,
                    "end": 1324.97,
                    "word": " coin",
                    "probability": 0.7197265625
                },
                {
                    "start": 1324.97,
                    "end": 1325.55,
                    "word": " mines",
                    "probability": 0.400146484375
                },
                {
                    "start": 1325.55,
                    "end": 1326.65,
                    "word": " mined",
                    "probability": 0.69189453125
                },
                {
                    "start": 1326.65,
                    "end": 1326.93,
                    "word": " by",
                    "probability": 0.900390625
                },
                {
                    "start": 1326.93,
                    "end": 1327.29,
                    "word": " attackers",
                    "probability": 0.00013899803161621094
                },
                {
                    "start": 1327.29,
                    "end": 1327.69,
                    "word": " on",
                    "probability": 0.88818359375
                },
                {
                    "start": 1327.69,
                    "end": 1328.05,
                    "word": " various",
                    "probability": 0.68896484375
                },
                {
                    "start": 1328.05,
                    "end": 1328.45,
                    "word": " pools",
                    "probability": 0.77783203125
                },
                {
                    "start": 1328.45,
                    "end": 1328.93,
                    "word": ".",
                    "probability": 0.8134765625
                }
            ]
        },
        {
            "id": 215,
            "seek": 120760,
            "start": 1328.93,
            "end": 1333.25,
            "text": " As a footnote, some workers were still active last week.",
            "tokens": [
                50714,
                1018,
                257,
                2671,
                22178,
                11,
                512,
                5600,
                645,
                920,
                4967,
                1036,
                1243,
                13,
                50964
            ],
            "temperature": 0.0,
            "avg_logprob": -0.23092532622349726,
            "compression_ratio": 1.538860103626943,
            "no_speech_prob": 0.1290283203125,
            "words": [
                {
                    "start": 1328.93,
                    "end": 1329.07,
                    "word": " As",
                    "probability": 0.78369140625
                },
                {
                    "start": 1329.17,
                    "end": 1329.61,
                    "word": " a footnote",
                    "probability": 0.789306640625
                },
                {
                    "start": 1329.61,
                    "end": 1330.33,
                    "word": ",",
                    "probability": 0.8076171875
                },
                {
                    "start": 1330.33,
                    "end": 1330.67,
                    "word": " some",
                    "probability": 0.81787109375
                },
                {
                    "start": 1330.67,
                    "end": 1331.09,
                    "word": " workers",
                    "probability": 0.76513671875
                },
                {
                    "start": 1331.09,
                    "end": 1331.33,
                    "word": " were",
                    "probability": 0.8564453125
                },
                {
                    "start": 1331.33,
                    "end": 1331.59,
                    "word": " still",
                    "probability": 0.9208984375
                },
                {
                    "start": 1331.59,
                    "end": 1331.97,
                    "word": " active",
                    "probability": 0.8193359375
                },
                {
                    "start": 1331.97,
                    "end": 1332.23,
                    "word": " last",
                    "probability": 0.79736328125
                },
                {
                    "start": 1332.23,
                    "end": 1332.53,
                    "word": " week",
                    "probability": 0.8388671875
                },
                {
                    "start": 1332.53,
                    "end": 1333.25,
                    "word": ".",
                    "probability": 0.7900390625
                }
            ]
        },
        {
            "id": 216,
            "seek": 120760,
            "start": 1333.65,
            "end": 1335.59,
            "text": " But back to the case.",
            "tokens": [
                50964,
                583,
                646,
                281,
                264,
                1389,
                13,
                51064
            ],
            "temperature": 0.0,
            "avg_logprob": -0.23092532622349726,
            "compression_ratio": 1.538860103626943,
            "no_speech_prob": 0.1290283203125,
            "words": [
                {
                    "start": 1333.65,
                    "end": 1334.11,
                    "word": " But",
                    "probability": 0.8115234375
                },
                {
                    "start": 1334.11,
                    "end": 1334.29,
                    "word": " back",
                    "probability": 0.77978515625
                },
                {
                    "start": 1334.29,
                    "end": 1334.45,
                    "word": " to",
                    "probability": 0.90625
                },
                {
                    "start": 1334.45,
                    "end": 1334.59,
                    "word": " the",
                    "probability": 0.81982421875
                },
                {
                    "start": 1334.59,
                    "end": 1334.87,
                    "word": " case",
                    "probability": 0.80712890625
                },
                {
                    "start": 1334.87,
                    "end": 1335.59,
                    "word": ".",
                    "probability": 0.67431640625
                }
            ]
        },
        {
            "id": 217,
            "seek": 120760,
            "start": 1335.85,
            "end": 1349.19,
            "text": " In the cases we discovered, attackers have mined approximately 150 monero coins in total, which is now approximately 13,000 USD.",
            "tokens": [
                51064,
                682,
                264,
                3331,
                321,
                6941,
                11,
                45129,
                362,
                923,
                292,
                10447,
                8451,
                1108,
                2032,
                13561,
                294,
                3217,
                11,
                597,
                307,
                586,
                10447,
                3705,
                11,
                1360,
                624,
                23969,
                13,
                51764
            ],
            "temperature": 0.0,
            "avg_logprob": -0.23092532622349726,
            "compression_ratio": 1.538860103626943,
            "no_speech_prob": 0.1290283203125,
            "words": [
                {
                    "start": 1335.85,
                    "end": 1336.57,
                    "word": " In",
                    "probability": 0.8818359375
                },
                {
                    "start": 1336.57,
                    "end": 1336.71,
                    "word": " the",
                    "probability": 0.8125
                },
                {
                    "start": 1336.71,
                    "end": 1336.99,
                    "word": " cases",
                    "probability": 0.77294921875
                },
                {
                    "start": 1336.99,
                    "end": 1337.23,
                    "word": " we",
                    "probability": 0.861328125
                },
                {
                    "start": 1337.23,
                    "end": 1337.81,
                    "word": " discovered",
                    "probability": 0.6337890625
                },
                {
                    "start": 1337.81,
                    "end": 1338.57,
                    "word": ",",
                    "probability": 0.8544921875
                },
                {
                    "start": 1338.57,
                    "end": 1339.21,
                    "word": " attackers",
                    "probability": 0.42041015625
                },
                {
                    "start": 1339.21,
                    "end": 1339.55,
                    "word": " have",
                    "probability": 0.83544921875
                },
                {
                    "start": 1339.55,
                    "end": 1339.91,
                    "word": " mined",
                    "probability": 0.86865234375
                },
                {
                    "start": 1339.91,
                    "end": 1340.63,
                    "word": " approximately",
                    "probability": 0.822265625
                },
                {
                    "start": 1340.63,
                    "end": 1341.89,
                    "word": " 150",
                    "probability": 0.71923828125
                },
                {
                    "start": 1341.89,
                    "end": 1342.67,
                    "word": " monero",
                    "probability": 0.87890625
                },
                {
                    "start": 1342.67,
                    "end": 1343.05,
                    "word": " coins",
                    "probability": 0.806640625
                },
                {
                    "start": 1343.05,
                    "end": 1343.25,
                    "word": " in",
                    "probability": 0.900390625
                },
                {
                    "start": 1343.25,
                    "end": 1343.57,
                    "word": " total",
                    "probability": 0.79443359375
                },
                {
                    "start": 1343.57,
                    "end": 1344.43,
                    "word": ",",
                    "probability": 0.775390625
                },
                {
                    "start": 1344.43,
                    "end": 1344.69,
                    "word": " which",
                    "probability": 0.90966796875
                },
                {
                    "start": 1344.69,
                    "end": 1344.81,
                    "word": " is",
                    "probability": 0.9013671875
                },
                {
                    "start": 1344.81,
                    "end": 1345.07,
                    "word": " now",
                    "probability": 0.89013671875
                },
                {
                    "start": 1345.07,
                    "end": 1345.81,
                    "word": " approximately",
                    "probability": 0.8564453125
                },
                {
                    "start": 1345.81,
                    "end": 1346.93,
                    "word": " 13",
                    "probability": 0.6767578125
                },
                {
                    "start": 1346.93,
                    "end": 1347.93,
                    "word": ",000",
                    "probability": 0.852783203125
                },
                {
                    "start": 1347.93,
                    "end": 1348.47,
                    "word": " USD",
                    "probability": 0.55670166015625
                },
                {
                    "start": 1348.47,
                    "end": 1349.19,
                    "word": ".",
                    "probability": 0.97021484375
                }
            ]
        },
        {
            "id": 218,
            "seek": 123624,
            "start": 1349.19,
            "end": 1358.19,
            "text": " For comparison, average damages per day victim varies between $50,000 and $500,000.",
            "tokens": [
                50364,
                1171,
                9660,
                11,
                4274,
                28536,
                680,
                786,
                6760,
                21716,
                1296,
                1848,
                2803,
                11,
                1360,
                293,
                1848,
                7526,
                11,
                1360,
                13,
                50814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2376217586653573,
            "compression_ratio": 1.6462264150943395,
            "no_speech_prob": 0.0028171539306640625,
            "words": [
                {
                    "start": 1349.19,
                    "end": 1350.17,
                    "word": " For",
                    "probability": 0.8369140625
                },
                {
                    "start": 1350.17,
                    "end": 1350.65,
                    "word": " comparison",
                    "probability": 0.6865234375
                },
                {
                    "start": 1350.65,
                    "end": 1351.11,
                    "word": ",",
                    "probability": 0.88623046875
                },
                {
                    "start": 1351.11,
                    "end": 1351.37,
                    "word": " average",
                    "probability": 0.5693359375
                },
                {
                    "start": 1351.37,
                    "end": 1352.43,
                    "word": " damages",
                    "probability": 0.7587890625
                },
                {
                    "start": 1352.43,
                    "end": 1352.75,
                    "word": " per",
                    "probability": 0.8876953125
                },
                {
                    "start": 1352.75,
                    "end": 1352.97,
                    "word": " day",
                    "probability": 0.7060546875
                },
                {
                    "start": 1352.97,
                    "end": 1353.39,
                    "word": " victim",
                    "probability": 0.6123046875
                },
                {
                    "start": 1353.39,
                    "end": 1354.17,
                    "word": " varies",
                    "probability": 0.73291015625
                },
                {
                    "start": 1354.17,
                    "end": 1354.73,
                    "word": " between",
                    "probability": 0.76123046875
                },
                {
                    "start": 1354.73,
                    "end": 1355.97,
                    "word": " $50",
                    "probability": 0.678466796875
                },
                {
                    "start": 1355.97,
                    "end": 1356.05,
                    "word": ",000",
                    "probability": 0.849609375
                },
                {
                    "start": 1356.05,
                    "end": 1356.29,
                    "word": " and",
                    "probability": 0.7412109375
                },
                {
                    "start": 1356.29,
                    "end": 1356.89,
                    "word": " $500",
                    "probability": 0.946533203125
                },
                {
                    "start": 1356.89,
                    "end": 1357.45,
                    "word": ",000",
                    "probability": 0.996826171875
                },
                {
                    "start": 1357.45,
                    "end": 1358.19,
                    "word": ".",
                    "probability": 0.2176513671875
                }
            ]
        },
        {
            "id": 219,
            "seek": 123624,
            "start": 1358.19,
            "end": 1368.87,
            "text": " And this includes only the direct costs, such as incident response and remediation process, investigation and reinstallation of their systems.",
            "tokens": [
                50814,
                400,
                341,
                5974,
                787,
                264,
                2047,
                5497,
                11,
                1270,
                382,
                9348,
                4134,
                293,
                28718,
                6642,
                1399,
                11,
                9627,
                293,
                35056,
                336,
                399,
                295,
                641,
                3652,
                13,
                51314
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2376217586653573,
            "compression_ratio": 1.6462264150943395,
            "no_speech_prob": 0.0028171539306640625,
            "words": [
                {
                    "start": 1358.19,
                    "end": 1358.65,
                    "word": " And",
                    "probability": 0.56982421875
                },
                {
                    "start": 1358.65,
                    "end": 1358.85,
                    "word": " this",
                    "probability": 0.83154296875
                },
                {
                    "start": 1358.85,
                    "end": 1359.25,
                    "word": " includes",
                    "probability": 0.80419921875
                },
                {
                    "start": 1359.25,
                    "end": 1359.51,
                    "word": " only",
                    "probability": 0.83544921875
                },
                {
                    "start": 1359.51,
                    "end": 1359.67,
                    "word": " the",
                    "probability": 0.78271484375
                },
                {
                    "start": 1359.67,
                    "end": 1360.05,
                    "word": " direct",
                    "probability": 0.77880859375
                },
                {
                    "start": 1360.05,
                    "end": 1360.43,
                    "word": " costs",
                    "probability": 0.783203125
                },
                {
                    "start": 1360.43,
                    "end": 1360.67,
                    "word": ",",
                    "probability": 0.447509765625
                },
                {
                    "start": 1360.67,
                    "end": 1360.91,
                    "word": " such",
                    "probability": 0.8486328125
                },
                {
                    "start": 1360.91,
                    "end": 1361.21,
                    "word": " as",
                    "probability": 0.92041015625
                },
                {
                    "start": 1361.21,
                    "end": 1361.51,
                    "word": " incident",
                    "probability": 0.828125
                },
                {
                    "start": 1361.51,
                    "end": 1362.07,
                    "word": " response",
                    "probability": 0.88134765625
                },
                {
                    "start": 1362.07,
                    "end": 1362.27,
                    "word": " and",
                    "probability": 0.73828125
                },
                {
                    "start": 1362.27,
                    "end": 1362.95,
                    "word": " remediation",
                    "probability": 0.7259521484375
                },
                {
                    "start": 1362.95,
                    "end": 1364.69,
                    "word": " process",
                    "probability": 0.75341796875
                },
                {
                    "start": 1364.69,
                    "end": 1365.25,
                    "word": ",",
                    "probability": 0.8974609375
                },
                {
                    "start": 1365.25,
                    "end": 1366.19,
                    "word": " investigation",
                    "probability": 0.6474609375
                },
                {
                    "start": 1366.19,
                    "end": 1366.75,
                    "word": " and",
                    "probability": 0.599609375
                },
                {
                    "start": 1366.75,
                    "end": 1367.49,
                    "word": " reinstallation",
                    "probability": 0.7915852864583334
                },
                {
                    "start": 1367.49,
                    "end": 1367.69,
                    "word": " of",
                    "probability": 0.90869140625
                },
                {
                    "start": 1367.69,
                    "end": 1367.87,
                    "word": " their",
                    "probability": 0.77978515625
                },
                {
                    "start": 1367.87,
                    "end": 1368.37,
                    "word": " systems",
                    "probability": 0.833984375
                },
                {
                    "start": 1368.37,
                    "end": 1368.87,
                    "word": ".",
                    "probability": 0.9814453125
                }
            ]
        },
        {
            "id": 220,
            "seek": 123624,
            "start": 1368.87,
            "end": 1377.83,
            "text": " The indirect costs, such as reputation loss and disruption or damages due to downtime, aren't included in this estimation.",
            "tokens": [
                51314,
                440,
                19523,
                5497,
                11,
                1270,
                382,
                13061,
                4470,
                293,
                28751,
                420,
                28536,
                3462,
                281,
                49648,
                11,
                3212,
                380,
                5556,
                294,
                341,
                35701,
                13,
                51814
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2376217586653573,
            "compression_ratio": 1.6462264150943395,
            "no_speech_prob": 0.0028171539306640625,
            "words": [
                {
                    "start": 1368.87,
                    "end": 1369.01,
                    "word": " The",
                    "probability": 0.75927734375
                },
                {
                    "start": 1369.01,
                    "end": 1369.33,
                    "word": " indirect",
                    "probability": 0.90478515625
                },
                {
                    "start": 1369.33,
                    "end": 1369.83,
                    "word": " costs",
                    "probability": 0.79638671875
                },
                {
                    "start": 1369.83,
                    "end": 1370.07,
                    "word": ",",
                    "probability": 0.6953125
                },
                {
                    "start": 1370.07,
                    "end": 1370.23,
                    "word": " such",
                    "probability": 0.86767578125
                },
                {
                    "start": 1370.23,
                    "end": 1370.53,
                    "word": " as",
                    "probability": 0.90673828125
                },
                {
                    "start": 1370.53,
                    "end": 1371.39,
                    "word": " reputation",
                    "probability": 0.888671875
                },
                {
                    "start": 1371.39,
                    "end": 1371.97,
                    "word": " loss",
                    "probability": 0.364501953125
                },
                {
                    "start": 1371.97,
                    "end": 1372.45,
                    "word": " and",
                    "probability": 0.84033203125
                },
                {
                    "start": 1372.45,
                    "end": 1373.19,
                    "word": " disruption",
                    "probability": 0.82666015625
                },
                {
                    "start": 1373.19,
                    "end": 1374.15,
                    "word": " or",
                    "probability": 0.75927734375
                },
                {
                    "start": 1374.15,
                    "end": 1374.57,
                    "word": " damages",
                    "probability": 0.8115234375
                },
                {
                    "start": 1374.57,
                    "end": 1375.13,
                    "word": " due",
                    "probability": 0.87255859375
                },
                {
                    "start": 1375.13,
                    "end": 1375.33,
                    "word": " to",
                    "probability": 0.9013671875
                },
                {
                    "start": 1375.33,
                    "end": 1375.81,
                    "word": " downtime",
                    "probability": 0.8466796875
                },
                {
                    "start": 1375.81,
                    "end": 1376.13,
                    "word": ",",
                    "probability": 0.421142578125
                },
                {
                    "start": 1376.13,
                    "end": 1376.41,
                    "word": " aren't",
                    "probability": 0.831787109375
                },
                {
                    "start": 1376.41,
                    "end": 1376.79,
                    "word": " included",
                    "probability": 0.7822265625
                },
                {
                    "start": 1376.79,
                    "end": 1376.99,
                    "word": " in",
                    "probability": 0.90234375
                },
                {
                    "start": 1376.99,
                    "end": 1377.13,
                    "word": " this",
                    "probability": 0.85009765625
                },
                {
                    "start": 1377.13,
                    "end": 1377.59,
                    "word": " estimation",
                    "probability": 0.7626953125
                },
                {
                    "start": 1377.59,
                    "end": 1377.83,
                    "word": ".",
                    "probability": 0.9990234375
                }
            ]
        },
        {
            "id": 221,
            "seek": 125972,
            "start": 1379.33,
            "end": 1381.59,
            "text": " And last, but not least.",
            "tokens": [
                50414,
                400,
                1036,
                11,
                457,
                406,
                1935,
                13,
                50514
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2165743693520751,
            "compression_ratio": 1.483568075117371,
            "no_speech_prob": 0.035369873046875,
            "words": [
                {
                    "start": 1379.33,
                    "end": 1379.91,
                    "word": " And",
                    "probability": 0.53515625
                },
                {
                    "start": 1379.91,
                    "end": 1380.27,
                    "word": " last",
                    "probability": 0.7890625
                },
                {
                    "start": 1380.27,
                    "end": 1380.41,
                    "word": ",",
                    "probability": 0.3369140625
                },
                {
                    "start": 1380.41,
                    "end": 1380.53,
                    "word": " but",
                    "probability": 0.88916015625
                },
                {
                    "start": 1380.53,
                    "end": 1380.71,
                    "word": " not",
                    "probability": 0.89111328125
                },
                {
                    "start": 1380.71,
                    "end": 1381.03,
                    "word": " least",
                    "probability": 0.84765625
                },
                {
                    "start": 1381.03,
                    "end": 1381.59,
                    "word": ".",
                    "probability": 0.264404296875
                }
            ]
        },
        {
            "id": 222,
            "seek": 125972,
            "start": 1381.59,
            "end": 1384.59,
            "text": " What do we discovered in our analysis and research?",
            "tokens": [
                50514,
                708,
                360,
                321,
                6941,
                294,
                527,
                5215,
                293,
                2132,
                30,
                50664
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2165743693520751,
            "compression_ratio": 1.483568075117371,
            "no_speech_prob": 0.035369873046875,
            "words": [
                {
                    "start": 1381.59,
                    "end": 1381.69,
                    "word": " What",
                    "probability": 0.78857421875
                },
                {
                    "start": 1381.69,
                    "end": 1381.83,
                    "word": " do",
                    "probability": 0.66552734375
                },
                {
                    "start": 1381.83,
                    "end": 1381.97,
                    "word": " we",
                    "probability": 0.8935546875
                },
                {
                    "start": 1381.97,
                    "end": 1382.43,
                    "word": " discovered",
                    "probability": 0.40380859375
                },
                {
                    "start": 1382.43,
                    "end": 1382.63,
                    "word": " in",
                    "probability": 0.8818359375
                },
                {
                    "start": 1382.63,
                    "end": 1382.87,
                    "word": " our",
                    "probability": 0.810546875
                },
                {
                    "start": 1382.87,
                    "end": 1383.37,
                    "word": " analysis",
                    "probability": 0.5751953125
                },
                {
                    "start": 1383.37,
                    "end": 1383.65,
                    "word": " and",
                    "probability": 0.89013671875
                },
                {
                    "start": 1383.65,
                    "end": 1384.09,
                    "word": " research",
                    "probability": 0.7734375
                },
                {
                    "start": 1384.09,
                    "end": 1384.59,
                    "word": "?",
                    "probability": 0.92041015625
                }
            ]
        },
        {
            "id": 223,
            "seek": 125972,
            "start": 1384.59,
            "end": 1394.13,
            "text": " First of all, thanks to online databases and feeds, we are able to find missing pieces and reconstruct the whole attack performed by this red actor.",
            "tokens": [
                50664,
                2386,
                295,
                439,
                11,
                3231,
                281,
                2950,
                22380,
                293,
                23712,
                11,
                321,
                366,
                1075,
                281,
                915,
                5361,
                3755,
                293,
                31499,
                264,
                1379,
                2690,
                10332,
                538,
                341,
                2182,
                8747,
                13,
                51164
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2165743693520751,
            "compression_ratio": 1.483568075117371,
            "no_speech_prob": 0.035369873046875,
            "words": [
                {
                    "start": 1384.59,
                    "end": 1384.91,
                    "word": " First",
                    "probability": 0.8740234375
                },
                {
                    "start": 1384.91,
                    "end": 1385.09,
                    "word": " of",
                    "probability": 0.90283203125
                },
                {
                    "start": 1385.09,
                    "end": 1385.37,
                    "word": " all",
                    "probability": 0.89990234375
                },
                {
                    "start": 1385.37,
                    "end": 1385.95,
                    "word": ",",
                    "probability": 0.931640625
                },
                {
                    "start": 1385.95,
                    "end": 1386.19,
                    "word": " thanks",
                    "probability": 0.68359375
                },
                {
                    "start": 1386.19,
                    "end": 1386.35,
                    "word": " to",
                    "probability": 0.90771484375
                },
                {
                    "start": 1386.35,
                    "end": 1386.61,
                    "word": " online",
                    "probability": 0.75537109375
                },
                {
                    "start": 1386.61,
                    "end": 1387.11,
                    "word": " databases",
                    "probability": 0.896484375
                },
                {
                    "start": 1387.11,
                    "end": 1387.53,
                    "word": " and",
                    "probability": 0.880859375
                },
                {
                    "start": 1387.53,
                    "end": 1387.83,
                    "word": " feeds",
                    "probability": 0.7646484375
                },
                {
                    "start": 1387.83,
                    "end": 1388.21,
                    "word": ",",
                    "probability": 0.7294921875
                },
                {
                    "start": 1388.21,
                    "end": 1388.31,
                    "word": " we",
                    "probability": 0.87890625
                },
                {
                    "start": 1388.31,
                    "end": 1388.43,
                    "word": " are",
                    "probability": 0.62353515625
                },
                {
                    "start": 1388.43,
                    "end": 1388.69,
                    "word": " able",
                    "probability": 0.873046875
                },
                {
                    "start": 1388.69,
                    "end": 1388.89,
                    "word": " to",
                    "probability": 0.9052734375
                },
                {
                    "start": 1388.89,
                    "end": 1389.17,
                    "word": " find",
                    "probability": 0.814453125
                },
                {
                    "start": 1389.17,
                    "end": 1389.51,
                    "word": " missing",
                    "probability": 0.84130859375
                },
                {
                    "start": 1389.51,
                    "end": 1389.87,
                    "word": " pieces",
                    "probability": 0.65283203125
                },
                {
                    "start": 1389.87,
                    "end": 1390.19,
                    "word": " and",
                    "probability": 0.875
                },
                {
                    "start": 1390.19,
                    "end": 1390.63,
                    "word": " reconstruct",
                    "probability": 0.79638671875
                },
                {
                    "start": 1390.63,
                    "end": 1391.61,
                    "word": " the",
                    "probability": 0.80859375
                },
                {
                    "start": 1391.61,
                    "end": 1391.97,
                    "word": " whole",
                    "probability": 0.7626953125
                },
                {
                    "start": 1391.97,
                    "end": 1392.31,
                    "word": " attack",
                    "probability": 0.830078125
                },
                {
                    "start": 1392.31,
                    "end": 1392.69,
                    "word": " performed",
                    "probability": 0.72216796875
                },
                {
                    "start": 1392.69,
                    "end": 1392.95,
                    "word": " by",
                    "probability": 0.91015625
                },
                {
                    "start": 1392.95,
                    "end": 1393.11,
                    "word": " this",
                    "probability": 0.85595703125
                },
                {
                    "start": 1393.11,
                    "end": 1393.29,
                    "word": " red",
                    "probability": 0.6982421875
                },
                {
                    "start": 1393.29,
                    "end": 1393.55,
                    "word": " actor",
                    "probability": 0.31640625
                },
                {
                    "start": 1393.55,
                    "end": 1394.13,
                    "word": ".",
                    "probability": 0.970703125
                }
            ]
        },
        {
            "id": 224,
            "seek": 125972,
            "start": 1394.31,
            "end": 1401.31,
            "text": " In the meantime, this red actor got a name, Blue Mockingbird, given by Red Canary Company.",
            "tokens": [
                51164,
                682,
                264,
                14991,
                11,
                341,
                2182,
                8747,
                658,
                257,
                1315,
                11,
                8510,
                376,
                31730,
                18080,
                11,
                2212,
                538,
                4477,
                1664,
                822,
                13918,
                13,
                51514
            ],
            "temperature": 0.0,
            "avg_logprob": -0.2165743693520751,
            "compression_ratio": 1.483568075117371,
            "no_speech_prob": 0.035369873046875,
            "words": [
                {
                    "start": 1394.31,
                    "end": 1394.79,
                    "word": " In",
                    "probability": 0.83740234375
                },
                {
                    "start": 1394.79,
                    "end": 1394.91,
                    "word": " the",
                    "probability": 0.8134765625
                },
                {
                    "start": 1394.91,
                    "end": 1395.35,
                    "word": " meantime",
                    "probability": 0.83203125
                },
                {
                    "start": 1395.35,
                    "end": 1396.11,
                    "word": ",",
                    "probability": 0.939453125
                },
                {
                    "start": 1396.11,
                    "end": 1396.25,
                    "word": " this",
                    "probability": 0.83349609375
                },
                {
                    "start": 1396.25,
                    "end": 1396.45,
                    "word": " red",
                    "probability": 0.74169921875
                },
                {
                    "start": 1396.45,
                    "end": 1396.77,
                    "word": " actor",
                    "probability": 0.81396484375
                },
                {
                    "start": 1396.77,
                    "end": 1397.03,
                    "word": " got",
                    "probability": 0.8662109375
                },
                {
                    "start": 1397.19,
                    "end": 1397.45,
                    "word": " a name",
                    "probability": 0.83251953125
                },
                {
                    "start": 1397.45,
                    "end": 1397.97,
                    "word": ",",
                    "probability": 0.4912109375
                },
                {
                    "start": 1397.97,
                    "end": 1398.17,
                    "word": " Blue",
                    "probability": 0.446533203125
                },
                {
                    "start": 1398.17,
                    "end": 1398.81,
                    "word": " Mockingbird",
                    "probability": 0.8844401041666666
                },
                {
                    "start": 1398.81,
                    "end": 1399.01,
                    "word": ",",
                    "probability": 0.55419921875
                },
                {
                    "start": 1399.01,
                    "end": 1399.25,
                    "word": " given",
                    "probability": 0.80029296875
                },
                {
                    "start": 1399.25,
                    "end": 1399.51,
                    "word": " by",
                    "probability": 0.908203125
                },
                {
                    "start": 1399.51,
                    "end": 1399.99,
                    "word": " Red",
                    "probability": 0.564453125
                },
                {
                    "start": 1399.99,
                    "end": 1400.29,
                    "word": " Canary",
                    "probability": 0.89453125
                },
                {
                    "start": 1400.29,
                    "end": 1400.73,
                    "word": " Company",
                    "probability": 0.6025390625
                },
                {
                    "start": 1400.73,
                    "end": 1401.31,
                    "word": ".",
                    "probability": 0.984375
                }
            ]
        },
        {
            "id": 225,
            "seek": 128202,
            "start": 1401.31,
            "end": 1412.75,
            "text": " We observed that they were capable to adapt and customize various tools from GitHub and put all the data in their unpacker and installation scripts.",
            "tokens": [
                50364,
                492,
                13095,
                300,
                436,
                645,
                8189,
                281,
                6231,
                293,
                19734,
                3683,
                3873,
                490,
                23331,
                293,
                829,
                439,
                264,
                1412,
                294,
                641,
                26699,
                260,
                293,
                13260,
                23294,
                13,
                50914
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24023437798023223,
            "compression_ratio": 1.435897435897436,
            "no_speech_prob": 0.2454833984375,
            "words": [
                {
                    "start": 1401.31,
                    "end": 1401.79,
                    "word": " We",
                    "probability": 0.7490234375
                },
                {
                    "start": 1401.79,
                    "end": 1402.35,
                    "word": " observed",
                    "probability": 0.708984375
                },
                {
                    "start": 1402.35,
                    "end": 1402.71,
                    "word": " that",
                    "probability": 0.84228515625
                },
                {
                    "start": 1402.71,
                    "end": 1402.87,
                    "word": " they",
                    "probability": 0.74169921875
                },
                {
                    "start": 1402.87,
                    "end": 1403.07,
                    "word": " were",
                    "probability": 0.86181640625
                },
                {
                    "start": 1403.07,
                    "end": 1403.59,
                    "word": " capable",
                    "probability": 0.80078125
                },
                {
                    "start": 1403.59,
                    "end": 1403.83,
                    "word": " to",
                    "probability": 0.86962890625
                },
                {
                    "start": 1403.83,
                    "end": 1404.19,
                    "word": " adapt",
                    "probability": 0.779296875
                },
                {
                    "start": 1404.19,
                    "end": 1404.43,
                    "word": " and",
                    "probability": 0.89453125
                },
                {
                    "start": 1404.43,
                    "end": 1405.01,
                    "word": " customize",
                    "probability": 0.64306640625
                },
                {
                    "start": 1405.01,
                    "end": 1405.73,
                    "word": " various",
                    "probability": 0.630859375
                },
                {
                    "start": 1405.73,
                    "end": 1406.11,
                    "word": " tools",
                    "probability": 0.794921875
                },
                {
                    "start": 1406.11,
                    "end": 1406.47,
                    "word": " from",
                    "probability": 0.810546875
                },
                {
                    "start": 1406.47,
                    "end": 1406.83,
                    "word": " GitHub",
                    "probability": 0.7470703125
                },
                {
                    "start": 1406.83,
                    "end": 1407.27,
                    "word": " and",
                    "probability": 0.767578125
                },
                {
                    "start": 1407.27,
                    "end": 1407.57,
                    "word": " put",
                    "probability": 0.857421875
                },
                {
                    "start": 1407.57,
                    "end": 1407.89,
                    "word": " all",
                    "probability": 0.84521484375
                },
                {
                    "start": 1407.89,
                    "end": 1408.51,
                    "word": " the",
                    "probability": 0.57666015625
                },
                {
                    "start": 1408.51,
                    "end": 1409.19,
                    "word": " data",
                    "probability": 0.414306640625
                },
                {
                    "start": 1409.19,
                    "end": 1409.83,
                    "word": " in",
                    "probability": 0.83544921875
                },
                {
                    "start": 1409.83,
                    "end": 1410.09,
                    "word": " their",
                    "probability": 0.7958984375
                },
                {
                    "start": 1410.09,
                    "end": 1410.69,
                    "word": " unpacker",
                    "probability": 0.749755859375
                },
                {
                    "start": 1410.69,
                    "end": 1410.99,
                    "word": " and",
                    "probability": 0.87744140625
                },
                {
                    "start": 1410.99,
                    "end": 1411.47,
                    "word": " installation",
                    "probability": 0.8818359375
                },
                {
                    "start": 1411.47,
                    "end": 1411.91,
                    "word": " scripts",
                    "probability": 0.6552734375
                },
                {
                    "start": 1411.91,
                    "end": 1412.75,
                    "word": ".",
                    "probability": 0.90478515625
                }
            ]
        },
        {
            "id": 226,
            "seek": 128202,
            "start": 1412.93,
            "end": 1419.47,
            "text": " It is unusual to see so many persistence methods used in one attack.",
            "tokens": [
                50914,
                467,
                307,
                10901,
                281,
                536,
                370,
                867,
                37617,
                7150,
                1143,
                294,
                472,
                2690,
                13,
                51264
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24023437798023223,
            "compression_ratio": 1.435897435897436,
            "no_speech_prob": 0.2454833984375,
            "words": [
                {
                    "start": 1412.93,
                    "end": 1413.27,
                    "word": " It",
                    "probability": 0.88720703125
                },
                {
                    "start": 1413.27,
                    "end": 1413.45,
                    "word": " is",
                    "probability": 0.8955078125
                },
                {
                    "start": 1413.45,
                    "end": 1413.83,
                    "word": " unusual",
                    "probability": 0.853515625
                },
                {
                    "start": 1413.83,
                    "end": 1414.41,
                    "word": " to",
                    "probability": 0.89404296875
                },
                {
                    "start": 1414.41,
                    "end": 1414.65,
                    "word": " see",
                    "probability": 0.8056640625
                },
                {
                    "start": 1414.65,
                    "end": 1414.91,
                    "word": " so",
                    "probability": 0.8984375
                },
                {
                    "start": 1414.91,
                    "end": 1415.17,
                    "word": " many",
                    "probability": 0.81103515625
                },
                {
                    "start": 1415.17,
                    "end": 1415.59,
                    "word": " persistence",
                    "probability": 0.53125
                },
                {
                    "start": 1415.59,
                    "end": 1416.11,
                    "word": " methods",
                    "probability": 0.82421875
                },
                {
                    "start": 1416.11,
                    "end": 1416.85,
                    "word": " used",
                    "probability": 0.80712890625
                },
                {
                    "start": 1416.85,
                    "end": 1418.03,
                    "word": " in",
                    "probability": 0.7919921875
                },
                {
                    "start": 1418.03,
                    "end": 1418.29,
                    "word": " one",
                    "probability": 0.74853515625
                },
                {
                    "start": 1418.29,
                    "end": 1418.63,
                    "word": " attack",
                    "probability": 0.261474609375
                },
                {
                    "start": 1418.63,
                    "end": 1419.47,
                    "word": ".",
                    "probability": 0.94091796875
                }
            ]
        },
        {
            "id": 227,
            "seek": 128202,
            "start": 1419.61,
            "end": 1423.61,
            "text": " This probably required research performed by Blue Mockingbird.",
            "tokens": [
                51264,
                639,
                1391,
                4739,
                2132,
                10332,
                538,
                8510,
                376,
                31730,
                18080,
                13,
                51464
            ],
            "temperature": 0.0,
            "avg_logprob": -0.24023437798023223,
            "compression_ratio": 1.435897435897436,
            "no_speech_prob": 0.2454833984375,
            "words": [
                {
                    "start": 1419.61,
                    "end": 1420.21,
                    "word": " This",
                    "probability": 0.568359375
                },
                {
                    "start": 1420.21,
                    "end": 1420.57,
                    "word": " probably",
                    "probability": 0.90087890625
                },
                {
                    "start": 1420.57,
                    "end": 1421.21,
                    "word": " required",
                    "probability": 0.71826171875
                },
                {
                    "start": 1421.21,
                    "end": 1421.77,
                    "word": " research",
                    "probability": 0.654296875
                },
                {
                    "start": 1421.77,
                    "end": 1422.25,
                    "word": " performed",
                    "probability": 0.68310546875
                },
                {
                    "start": 1422.25,
                    "end": 1422.49,
                    "word": " by",
                    "probability": 0.9052734375
                },
                {
                    "start": 1422.49,
                    "end": 1422.71,
                    "word": " Blue",
                    "probability": 0.1419677734375
                },
                {
                    "start": 1422.71,
                    "end": 1423.19,
                    "word": " Mockingbird",
                    "probability": 0.5996907552083334
                },
                {
                    "start": 1423.19,
                    "end": 1423.61,
                    "word": ".",
                    "probability": 0.6513671875
                }
            ]
        },
        {
            "id": 228,
            "seek": 130852,
            "start": 1423.61,
            "end": 1432.83,
            "text": " After that, they were able to earn thousands of dollars, but the victim damages are much greater than the attackers' profit.",
            "tokens": [
                50364,
                2381,
                300,
                11,
                436,
                645,
                1075,
                281,
                6012,
                5383,
                295,
                3808,
                11,
                457,
                264,
                6760,
                28536,
                366,
                709,
                5044,
                813,
                264,
                45129,
                6,
                7475,
                13,
                50864
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22830882142571843,
            "compression_ratio": 1.5541125541125542,
            "no_speech_prob": 0.2235107421875,
            "words": [
                {
                    "start": 1423.61,
                    "end": 1424.31,
                    "word": " After",
                    "probability": 0.6591796875
                },
                {
                    "start": 1424.31,
                    "end": 1424.61,
                    "word": " that",
                    "probability": 0.85888671875
                },
                {
                    "start": 1424.61,
                    "end": 1425.09,
                    "word": ",",
                    "probability": 0.56689453125
                },
                {
                    "start": 1425.09,
                    "end": 1425.19,
                    "word": " they",
                    "probability": 0.72802734375
                },
                {
                    "start": 1425.19,
                    "end": 1425.39,
                    "word": " were",
                    "probability": 0.8232421875
                },
                {
                    "start": 1425.39,
                    "end": 1425.65,
                    "word": " able",
                    "probability": 0.8759765625
                },
                {
                    "start": 1425.65,
                    "end": 1425.97,
                    "word": " to",
                    "probability": 0.90283203125
                },
                {
                    "start": 1425.97,
                    "end": 1426.31,
                    "word": " earn",
                    "probability": 0.90283203125
                },
                {
                    "start": 1426.31,
                    "end": 1426.75,
                    "word": " thousands",
                    "probability": 0.79931640625
                },
                {
                    "start": 1426.75,
                    "end": 1426.97,
                    "word": " of",
                    "probability": 0.90576171875
                },
                {
                    "start": 1426.97,
                    "end": 1427.33,
                    "word": " dollars",
                    "probability": 0.89501953125
                },
                {
                    "start": 1427.33,
                    "end": 1427.81,
                    "word": ",",
                    "probability": 0.5625
                },
                {
                    "start": 1427.81,
                    "end": 1428.17,
                    "word": " but",
                    "probability": 0.88037109375
                },
                {
                    "start": 1428.17,
                    "end": 1428.33,
                    "word": " the",
                    "probability": 0.806640625
                },
                {
                    "start": 1428.33,
                    "end": 1428.75,
                    "word": " victim",
                    "probability": 0.80810546875
                },
                {
                    "start": 1428.75,
                    "end": 1429.37,
                    "word": " damages",
                    "probability": 0.4443359375
                },
                {
                    "start": 1429.37,
                    "end": 1430.13,
                    "word": " are",
                    "probability": 0.8642578125
                },
                {
                    "start": 1430.13,
                    "end": 1430.53,
                    "word": " much",
                    "probability": 0.81103515625
                },
                {
                    "start": 1430.53,
                    "end": 1430.95,
                    "word": " greater",
                    "probability": 0.84228515625
                },
                {
                    "start": 1430.95,
                    "end": 1431.27,
                    "word": " than",
                    "probability": 0.880859375
                },
                {
                    "start": 1431.27,
                    "end": 1431.43,
                    "word": " the",
                    "probability": 0.791015625
                },
                {
                    "start": 1431.43,
                    "end": 1431.79,
                    "word": " attackers",
                    "probability": 0.6484375
                },
                {
                    "start": 1431.79,
                    "end": 1432.03,
                    "word": "'",
                    "probability": 0.137939453125
                },
                {
                    "start": 1432.03,
                    "end": 1432.23,
                    "word": " profit",
                    "probability": 0.85595703125
                },
                {
                    "start": 1432.23,
                    "end": 1432.83,
                    "word": ".",
                    "probability": 0.9521484375
                }
            ]
        },
        {
            "id": 229,
            "seek": 130852,
            "start": 1433.57,
            "end": 1439.33,
            "text": " So, that's all from my side. Here are provided some resources related to this talk.",
            "tokens": [
                50864,
                407,
                11,
                300,
                311,
                439,
                490,
                452,
                1252,
                13,
                1692,
                366,
                5649,
                512,
                3593,
                4077,
                281,
                341,
                751,
                13,
                51214
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22830882142571843,
            "compression_ratio": 1.5541125541125542,
            "no_speech_prob": 0.2235107421875,
            "words": [
                {
                    "start": 1433.57,
                    "end": 1434.17,
                    "word": " So",
                    "probability": 0.81787109375
                },
                {
                    "start": 1434.17,
                    "end": 1434.35,
                    "word": ",",
                    "probability": 0.4873046875
                },
                {
                    "start": 1434.35,
                    "end": 1434.61,
                    "word": " that's",
                    "probability": 0.923828125
                },
                {
                    "start": 1434.61,
                    "end": 1434.79,
                    "word": " all",
                    "probability": 0.9033203125
                },
                {
                    "start": 1434.79,
                    "end": 1434.97,
                    "word": " from",
                    "probability": 0.73583984375
                },
                {
                    "start": 1434.97,
                    "end": 1435.19,
                    "word": " my",
                    "probability": 0.89208984375
                },
                {
                    "start": 1435.19,
                    "end": 1435.53,
                    "word": " side",
                    "probability": 0.7802734375
                },
                {
                    "start": 1435.53,
                    "end": 1436.01,
                    "word": ".",
                    "probability": 0.76513671875
                },
                {
                    "start": 1436.01,
                    "end": 1436.23,
                    "word": " Here",
                    "probability": 0.82177734375
                },
                {
                    "start": 1436.23,
                    "end": 1436.47,
                    "word": " are",
                    "probability": 0.61474609375
                },
                {
                    "start": 1436.47,
                    "end": 1436.87,
                    "word": " provided",
                    "probability": 0.810546875
                },
                {
                    "start": 1436.87,
                    "end": 1437.11,
                    "word": " some",
                    "probability": 0.8134765625
                },
                {
                    "start": 1437.11,
                    "end": 1437.53,
                    "word": " resources",
                    "probability": 0.77880859375
                },
                {
                    "start": 1437.53,
                    "end": 1438.05,
                    "word": " related",
                    "probability": 0.8349609375
                },
                {
                    "start": 1438.05,
                    "end": 1438.27,
                    "word": " to",
                    "probability": 0.87353515625
                },
                {
                    "start": 1438.27,
                    "end": 1438.45,
                    "word": " this",
                    "probability": 0.8837890625
                },
                {
                    "start": 1438.45,
                    "end": 1438.73,
                    "word": " talk",
                    "probability": 0.79931640625
                },
                {
                    "start": 1438.73,
                    "end": 1439.33,
                    "word": ".",
                    "probability": 0.70068359375
                }
            ]
        },
        {
            "id": 230,
            "seek": 130852,
            "start": 1440.39,
            "end": 1447.51,
            "text": " And additionally, you can read something about my work or research on our company website or on my personal blog.",
            "tokens": [
                51214,
                400,
                43181,
                11,
                291,
                393,
                1401,
                746,
                466,
                452,
                589,
                420,
                2132,
                322,
                527,
                2237,
                3144,
                420,
                322,
                452,
                2973,
                6968,
                13,
                51564
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22830882142571843,
            "compression_ratio": 1.5541125541125542,
            "no_speech_prob": 0.2235107421875,
            "words": [
                {
                    "start": 1440.39,
                    "end": 1440.81,
                    "word": " And",
                    "probability": 0.58349609375
                },
                {
                    "start": 1440.81,
                    "end": 1441.33,
                    "word": " additionally",
                    "probability": 0.609375
                },
                {
                    "start": 1441.33,
                    "end": 1441.61,
                    "word": ",",
                    "probability": 0.85595703125
                },
                {
                    "start": 1441.61,
                    "end": 1441.73,
                    "word": " you",
                    "probability": 0.88720703125
                },
                {
                    "start": 1441.73,
                    "end": 1441.85,
                    "word": " can",
                    "probability": 0.89892578125
                },
                {
                    "start": 1441.85,
                    "end": 1442.07,
                    "word": " read",
                    "probability": 0.92626953125
                },
                {
                    "start": 1442.07,
                    "end": 1442.33,
                    "word": " something",
                    "probability": 0.73876953125
                },
                {
                    "start": 1442.33,
                    "end": 1442.77,
                    "word": " about",
                    "probability": 0.818359375
                },
                {
                    "start": 1442.77,
                    "end": 1443.07,
                    "word": " my",
                    "probability": 0.90283203125
                },
                {
                    "start": 1443.07,
                    "end": 1443.37,
                    "word": " work",
                    "probability": 0.80859375
                },
                {
                    "start": 1443.37,
                    "end": 1443.53,
                    "word": " or",
                    "probability": 0.85791015625
                },
                {
                    "start": 1443.53,
                    "end": 1444.03,
                    "word": " research",
                    "probability": 0.76611328125
                },
                {
                    "start": 1444.03,
                    "end": 1444.27,
                    "word": " on",
                    "probability": 0.89697265625
                },
                {
                    "start": 1444.27,
                    "end": 1444.55,
                    "word": " our",
                    "probability": 0.796875
                },
                {
                    "start": 1444.55,
                    "end": 1444.89,
                    "word": " company",
                    "probability": 0.744140625
                },
                {
                    "start": 1444.89,
                    "end": 1445.33,
                    "word": " website",
                    "probability": 0.8017578125
                },
                {
                    "start": 1445.33,
                    "end": 1446.15,
                    "word": " or",
                    "probability": 0.68115234375
                },
                {
                    "start": 1446.15,
                    "end": 1446.37,
                    "word": " on",
                    "probability": 0.8828125
                },
                {
                    "start": 1446.37,
                    "end": 1446.55,
                    "word": " my",
                    "probability": 0.89697265625
                },
                {
                    "start": 1446.55,
                    "end": 1446.93,
                    "word": " personal",
                    "probability": 0.71337890625
                },
                {
                    "start": 1446.93,
                    "end": 1447.27,
                    "word": " blog",
                    "probability": 0.86767578125
                },
                {
                    "start": 1447.27,
                    "end": 1447.51,
                    "word": ".",
                    "probability": 0.26220703125
                }
            ]
        },
        {
            "id": 231,
            "seek": 130852,
            "start": 1447.51,
            "end": 1450.11,
            "text": " And you can find me also on Twitter.",
            "tokens": [
                51564,
                400,
                291,
                393,
                915,
                385,
                611,
                322,
                5794,
                13,
                51714
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22830882142571843,
            "compression_ratio": 1.5541125541125542,
            "no_speech_prob": 0.2235107421875,
            "words": [
                {
                    "start": 1447.51,
                    "end": 1447.89,
                    "word": " And",
                    "probability": 0.83056640625
                },
                {
                    "start": 1447.89,
                    "end": 1448.01,
                    "word": " you",
                    "probability": 0.88232421875
                },
                {
                    "start": 1448.01,
                    "end": 1448.15,
                    "word": " can",
                    "probability": 0.90283203125
                },
                {
                    "start": 1448.15,
                    "end": 1448.49,
                    "word": " find",
                    "probability": 0.794921875
                },
                {
                    "start": 1448.49,
                    "end": 1448.73,
                    "word": " me",
                    "probability": 0.89990234375
                },
                {
                    "start": 1448.73,
                    "end": 1449.03,
                    "word": " also",
                    "probability": 0.79443359375
                },
                {
                    "start": 1449.03,
                    "end": 1449.25,
                    "word": " on",
                    "probability": 0.89697265625
                },
                {
                    "start": 1449.25,
                    "end": 1449.51,
                    "word": " Twitter",
                    "probability": 0.84326171875
                },
                {
                    "start": 1449.51,
                    "end": 1450.11,
                    "word": ".",
                    "probability": 0.98046875
                }
            ]
        },
        {
            "id": 232,
            "seek": 131553,
            "start": 1450.11,
            "end": 1456.03,
            "text": " So, thank you very much for attending this talk, and if you have any questions, please feel free to ask me.",
            "tokens": [
                50364,
                407,
                11,
                1309,
                291,
                588,
                709,
                337,
                15862,
                341,
                751,
                11,
                293,
                498,
                291,
                362,
                604,
                1651,
                11,
                1767,
                841,
                1737,
                281,
                1029,
                385,
                13,
                50664
            ],
            "temperature": 0.0,
            "avg_logprob": -0.22837612139327185,
            "compression_ratio": 1.1505376344086022,
            "no_speech_prob": 0.026885986328125,
            "words": [
                {
                    "start": 1450.11,
                    "end": 1450.77,
                    "word": " So",
                    "probability": 0.5625
                },
                {
                    "start": 1450.77,
                    "end": 1450.93,
                    "word": ",",
                    "probability": 0.44873046875
                },
                {
                    "start": 1450.93,
                    "end": 1451.07,
                    "word": " thank",
                    "probability": 0.810546875
                },
                {
                    "start": 1451.07,
                    "end": 1451.17,
                    "word": " you",
                    "probability": 0.90283203125
                },
                {
                    "start": 1451.17,
                    "end": 1451.33,
                    "word": " very",
                    "probability": 0.73193359375
                },
                {
                    "start": 1451.33,
                    "end": 1451.53,
                    "word": " much",
                    "probability": 0.8232421875
                },
                {
                    "start": 1451.53,
                    "end": 1451.67,
                    "word": " for",
                    "probability": 0.89599609375
                },
                {
                    "start": 1451.67,
                    "end": 1451.95,
                    "word": " attending",
                    "probability": 0.8603515625
                },
                {
                    "start": 1451.95,
                    "end": 1452.25,
                    "word": " this",
                    "probability": 0.876953125
                },
                {
                    "start": 1452.25,
                    "end": 1452.57,
                    "word": " talk",
                    "probability": 0.82568359375
                },
                {
                    "start": 1452.57,
                    "end": 1452.69,
                    "word": ",",
                    "probability": 0.295166015625
                },
                {
                    "start": 1452.69,
                    "end": 1452.79,
                    "word": " and",
                    "probability": 0.88232421875
                },
                {
                    "start": 1452.79,
                    "end": 1452.89,
                    "word": " if",
                    "probability": 0.89404296875
                },
                {
                    "start": 1452.89,
                    "end": 1452.99,
                    "word": " you",
                    "probability": 0.892578125
                },
                {
                    "start": 1452.99,
                    "end": 1453.17,
                    "word": " have",
                    "probability": 0.88818359375
                },
                {
                    "start": 1453.17,
                    "end": 1453.43,
                    "word": " any",
                    "probability": 0.82861328125
                },
                {
                    "start": 1453.43,
                    "end": 1453.95,
                    "word": " questions",
                    "probability": 0.88720703125
                },
                {
                    "start": 1453.95,
                    "end": 1454.51,
                    "word": ",",
                    "probability": 0.873046875
                },
                {
                    "start": 1454.51,
                    "end": 1454.77,
                    "word": " please",
                    "probability": 0.72509765625
                },
                {
                    "start": 1454.77,
                    "end": 1454.99,
                    "word": " feel",
                    "probability": 0.9111328125
                },
                {
                    "start": 1454.99,
                    "end": 1455.17,
                    "word": " free",
                    "probability": 0.8623046875
                },
                {
                    "start": 1455.17,
                    "end": 1455.33,
                    "word": " to",
                    "probability": 0.91455078125
                },
                {
                    "start": 1455.33,
                    "end": 1455.57,
                    "word": " ask",
                    "probability": 0.81298828125
                },
                {
                    "start": 1455.57,
                    "end": 1455.75,
                    "word": " me",
                    "probability": 0.91064453125
                },
                {
                    "start": 1455.75,
                    "end": 1456.03,
                    "word": ".",
                    "probability": 0.951171875
                }
            ]
        }
    ],
    "text": " Hello and welcome to my presentation with the title Hunting for Blue Mockingbird Coin Miners. I am Vladislav Bačov and I would like to spend the next 20 or 25 minutes with talking about incident response and investigation of the recent incidents attributed to the relatively new trade actor called Blue Mockingbird. But because we are in a recon village, this talk will not be about incident response only. Instead, I would like to share with you how our experiences have used reconnaissance and open source intelligence approaches to enrich our results from standard forensic and malware analysis. As often happens, the attackers have deleted some of their tools after they used them. However, with our recon and OSing approach, we were able to find them and reconstruct the original attack performed by the attackers. Moreover, we were able to track origin of the malware and we got insight into the technical capabilities of the Blue Mockingbird trade actor. And finally, in some cases, we could track the incomings of the cryptocurrency wallets used by Blue Mockingbirds and we can estimate profit of the attackers and compare it with the damage they caused to their victims. So, this is our agenda. And now, let me allow to introduce myself. Who am I? I am Vladislav Bačov and I currently work as a security senior consultant and malware analyst for Lifers, a New York City-based incident response and digital forensic company. In the past, I also worked for the government of one European country as an analyst in CSIRT, Computer Security Incident Response Team Slovakia. But now... Okay... We can ask one obvious question. Why a presentation about malware analysis, threat intelligence and OSing? There are a lot of automated solutions, such as antivirus scanners and sandboxes. So, why do we need to bother with additional malware analysis and enrichments with info from another public sources, if those automated solutions can identify most of the common threats? Well, the answer is hidden in the previous sentence. They can identify the most of the common threats. And I would like to emphasize the word common. When you need to deal with advanced threat actors or uncommon threats, such as rare or obfuscated malware samples, they can stay undetected by many of antivirus scanners and sandboxes. On the other hand, malware analysts can perform a brief analysis of those samples. And moreover, if they enrich the better results with intelligence info, they can quickly provide the rest of the team with accurate report. And this report can include not only the purpose and capabilities of the malware, but also origin of the samples or attributions to the threat actors. It can also help to reveal yet undiscovered steps of attacker, as well as it can recover yet missing pieces of malware puzzle used by attacker. And last but not least, this brief analysis with intelligence data can collect more indicator of compromise relevant for threat intelligence, for threat hunting and monitoring team. And when we are talking about using threat intelligence fees and other data sources, we can search for many attributes. There are obvious ones like URLs, hashes, and so on. But in addition, very helpful can be searched by file name, regular expressions, and malware classifications, such as categories and tags. Also, search for strings embedded in the malware or search by import hashes can discover more similar samples, which can be linked to the same attacks or to the same threat actors. And where to search? Here is a list of couple of examples, which will be covered later during this talk. And also, some of these tools can be very handy for the analyst. But these slides will be shared with you, so let's move forward. And okay, now we are ready to start with advertised incident response and infection with coin miners. So, it began with a high load of some computers. One could say, nothing strange, maybe only updates were being applied. But when local IT guys verified these machines, they noticed something unusual. Abnormally high CPU and memory usage by SVC host process. Moreover, the SVC host process corresponded with the problem reports and solution control panel support service. This could be a more serious problem, indeed. Antivirus did not find anything. But after manual submission of DLLs, the antivirus company identified them as coin miner or crypto mining variant. So, that's how the incident response began. We verified the findings of our client and we started analyzing machine with the coin miner. We followed the usual procedures and examined the provided evidence. We also verified signatures of DLLs in Windows System 32 directory and we checked those files against the National Software Reference Library database. As a result, we found a couple of malicious files. For example, this unknown file where CPL support E-DLL, which tries to mimics the legitimate one file name without E suffix. On the infected systems, there were a couple of DLLs marked as wannabe Windows System DLL files. But their hashes and also their file names were not present in any databases of known software and also in clean Windows systems they were not found. In addition, we saw that the extracted strings contained many occurrences of xamarin substrings, so we had to deal with infection of xamarin-based coin miner. And there is another thing common for all of these xamarin-based coin miner DLLs. They created a mutex called samplexn07 and this mutex ensures that only one instance of coin miner is running on each infected device. I need to add that this mutex name can be used as an additional indicator of compromise and also it can be used for finding another related samples in public databases. While the most detected fake DLLs had the same hash, there was only one with different hash. It executed the command line with the command for creation of scheduled task called windows-problem-collections and as well as other persistence via services. Thus, it was responsible for one part of persistent mechanism we already found. But the question is, what else attacker deployed in the client network and how they got access to the network? First steps of forensic analysis revealed the one batch file called x.bat and couple of suspicious tasks. The batch file contained the PowerShell downloader, which downloads additional content from JavaScript resource on the local web server. However, it was not JavaScript, but PowerShell, which created the scheduled task. And these scheduled tasks used the file called scriptstamp. In our case, it contains a backdoor, a Netcat backdoor. And what about its origin? The threat intelligence search based on file names and strings led us to the four years old scheduled task backdoor GitHub repository with Chinese comments in readme file. Forensic analysis also revealed DLLs files dropped by IIS worker process. The DLLs files were mixed mode assembly, so they contained both the managed and unmanaged code. The .NET part of DLL contains only the empty class. Yes, it was really empty. On the other hand, in the native code, this DLL main dispatcher spent a reverse shell connected to the attacker. And as I mentioned, there were more similar DLL files. However, these files differs only in two strings, which contained the original file name of DLL. So nothing, no significant differences in the functionality of these files. With the suspicion that this could be payload delivered after the exploitation of ASP.NET vulnerability because of IIS worker process, we tried to find something more about it. With the similarity in original build name, DLL names, it was easy to leverage the thread intelligence and found the particular vulnerability and the tool, which produces the same DLLs. It turns out that these files had been part of remote code execution exploit for vulnerability in Telerik web user interface for ASP.NET. This exploit can be found on GitHub, again. And after review, it was clear that this tool was used for building the DLLs with the reverse shell we just discovered. So we find the origin of this tool and also the initial letter of compromise. Further investigation and hunting for other persistence methods revealed the WMI event subscriptions. The attackers registered the event filter and consumer and also the filter to consumer binding. And as a result, it executed the same command as we already saw in the DLL files. Now, we thought that we were ready to start with remediation and removal the malicious artifacts from the network. We developed a custom PowerShell script for detection of all malicious stuff we were aware, including the malicious files and also the persistent artifacts. Then we deployed our scripts throughout EDR solution and there was a big surprise. EDR fired alert that there were detected attempts to install persistence for malicious DLLs we already known. So, we investigated those alerts and we found that those commands had been spawned by PowerShell process. Actually, the PowerShell process associated with our removal script. What? What the hell is this? We were absolutely sure that our PowerShell script didn't do anything like this. Its purpose was to remove malicious persistence, not to create new one. Yet we tested our script in our lab and also our client tested the script in their environment and nothing similar was observed. Hence, there was only one possible explanation of this. The attacker established another persistence method we did not find yet. Therefore, another investigation was needed. After a while, we found that the malicious DLL is loaded into the PowerShell process shortly after it queried the registry for specific class ID. And this class ID pointed to one of the malicious DLL files. Okay, but now there is another question. Why PowerShell was interested in this malicious class ID? The answer was hidden in the environment variables. Especially, there were two environment variables called core enable profiling and core profiler. They caused that every managed process was connected to the profiler specified by given class ID. So, the attacker misused the profiling of .NET applications. Great. Another small victory for defenders. Yeah. Now, before we continue, let's quickly summarize what we discovered until now. We already saw thousands of malware samples from four families. Coin miners, DLL installers for those coin miners, scheduled task backdoors, and reverse shells delivered after the exploitation. Regarding persistence, we already discovered malicious services and scheduled tasks. And later, we discovered and analyzed WMI event subscription and core profiler persistence. At this point, we had a lot of samples and persistence. But we were faced with the questions how the attacker installed all of these persistence artifacts, and what they exactly did between the initial exploitation and installation of coin miners on thousands of computers. Now, we really needed to enrich our results with external data from Threat Intelligence and OSINT. We used a clever tool called Munin by Florian Erot. All we needed to do was to create one file with hashes of malware samples and let Munin do its work. We found several hashes in public repositories, but there were only one public submission of the DLL installer, without any trace detected. When we did a context search instead of object search, we get another submission, as we can see in the picture. The zip archive with potentially malicious files. Now, let's look on the zipkernel file. It contains several DLLs, batch files, and one MOF file, which stands for Managed Object Format. We were familiar with some of them. One DLL was coin miner and the second was installer we already analyzed. The MOF file was interesting. Now, you can see its content on the right. It contained definitions of WMI event subscriptions used for persistence we found earlier. So, we got it. We found the WMI persistence. Now, we are aware how it was created. But what about the batch files? They were new for us, but there was a strong assumption that they were also related to the same ethics. When we examined the RNBAT file, we could say, Eureka! This batch file was an installation script for all stuff related to coin miners and persistence we already discovered. Thus, this is another piece of puzzle we missed until now. Second batch file, called sn.bat, was unpacker. It also seemed that the coin miners malicious stuff originally came as a package called set.zip. We also saw that this installation batch script was executed via a program called let.exe. But what was the let.exe and what files did the set.zip contain? We didn't find them yet. So, let's continue. We applied the same approach again and we tried to do a reconnaissance about let.exe and installation package. In some cases, we were able to follow tracks of the let.exe execution in public sources. It seemed that it was a kind of local privilege exploit. Then, suddenly, we found the one submission of set.zip on hybrid analysis. And this submission could be related to our investigation. And yes, this file was exactly the one we were hunting for, the installation package. And the program let.exe was included. As it turned out that our hypothesis was correct. The program let.exe was the juicy potato local privilege exploit with source codes available on GitHub. Again. Again on GitHub. There left only last sample. We don't analyze it until now. The nw.gold.dll from previous zip archive from any run. It was mixed-mod.dll file. Its name was composed from noun, timestamp, and architecture. And the managed code contains only empty .NET class, while the native code contains a dropper of unpacker batch file we saw before. But wait. Doesn't this nw.gold.dll file look familiar? Of course. We already saw the mixed-mod.dll with empty C-sharp class. It was reverse shell payload delivered by the Telerik WebUI exploitation. So let's compare these two files side by side. We can see that they contain a lot of similarity stuff. And we could assume that this dll had been also created with build scripts from Telerik WebUI exploit. But now, it was developed by TreadActor. Okay. We found all missing pieces of puzzle. We also collected all samples needed for attack reconstruction or simulation. And in that moment, we went one step further. We also collected the whole set of needed samples from public sources. Therefore, we could demonstrate this attack using public sandboxes without revealing any sensitive info from the private samples shared by our client. So, let's allow me to play a short video demonstration. Okay. Thank you for watching the video. And now, before we summarize our findings, let's proceed with the last part of this talk. The attacker's profit. We extracted crypto mining pool's parameters and configuration either from captured pickups or from memory dumps. Then, we used these parameters for hunting for more and more samples and repeated this process again and again. Finally, we collected several workers' IDs, but only two account IDs. These account IDs were reused in several cases. In the table, there are amounts of monero coin mines mined by attackers on various pools. As a footnote, some workers were still active last week. But back to the case. In the cases we discovered, attackers have mined approximately 150 monero coins in total, which is now approximately 13,000 USD. For comparison, average damages per day victim varies between $50,000 and $500,000. And this includes only the direct costs, such as incident response and remediation process, investigation and reinstallation of their systems. The indirect costs, such as reputation loss and disruption or damages due to downtime, aren't included in this estimation. And last, but not least. What do we discovered in our analysis and research? First of all, thanks to online databases and feeds, we are able to find missing pieces and reconstruct the whole attack performed by this red actor. In the meantime, this red actor got a name, Blue Mockingbird, given by Red Canary Company. We observed that they were capable to adapt and customize various tools from GitHub and put all the data in their unpacker and installation scripts. It is unusual to see so many persistence methods used in one attack. This probably required research performed by Blue Mockingbird. After that, they were able to earn thousands of dollars, but the victim damages are much greater than the attackers' profit. So, that's all from my side. Here are provided some resources related to this talk. And additionally, you can read something about my work or research on our company website or on my personal blog. And you can find me also on Twitter. So, thank you very much for attending this talk, and if you have any questions, please feel free to ask me."
}